CVE-2025-11359
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In code-projects Simple Banking System 1.0, a SQL injection vulnerability exists in an unknown function of the file /transfermoney.php. Manipulation of the argument ID leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
Risk Assessment
The risk includes potential unauthorized database access, theft of financial data, or manipulation of banking transactions.
Recommendation
Immediately update the system or apply security patches, and implement input validation and sanitization in /transfermoney.php.
Other vulnerabilities in Simple Banking System
See all- CVE-2025-11358Medium
In code-projects Simple Banking System 1.0, a weakness exists in an unknown function of the file /removeuser.php. Manipulation of the argument ID can lead to SQL injection. The attack may be launched remotely, and the exploit has been made public.
- CVE-2025-11357Medium
In code-projects Simple Banking System 1.0, a security flaw exists in some unknown processing of the file /createuser.php. Manipulation of the argument Name results in SQL injection. The attack may be initiated remotely, and the exploit has been released.
Original NVD description (English source)
A security vulnerability has been detected in code-projects Simple Banking System 1.0. The affected element is an unknown function of the file /transfermoney.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS