CVE-2025-11509
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A SQL injection vulnerability was found in code-projects E-Commerce Website 1.0 in the file /pages/product_add.php. Manipulating the prod_name argument allows remote attack. The exploit has been publicly disclosed and may be used.
Risk Assessment
An attacker could gain unauthorized access to the database, potentially leading to data leakage or modification of product data.
Recommendation
Apply patches, use parameterized queries, and restrict access to the application.
Other vulnerabilities in E-Commerce Website
See all- CVE-2025-11024Critical
There is an SQL injection vulnerability in Akilli Commerce software that allows for a Blind SQL Injection attack. This issue affects E-Commerce Website versions before 4.5.001.
- CVE-2025-11597Medium
A vulnerability was discovered in code-projects E-Commerce Website 1.0 involving SQL injection in the file /pages/product_add_qty.php. Manipulation of the prod_id argument allows remote attack execution. The exploit is publicly available and may be used.
- CVE-2025-11511Medium
A SQL injection vulnerability was found in code-projects E-Commerce Website 1.0 in the file /pages/supplier_add.php. Manipulating the supp_email argument allows remote attack. The exploit has been publicly disclosed and may be used.
Original NVD description (English source)
A vulnerability was detected in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/product_add.php. Performing manipulation of the argument prod_name results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS