CVE-2025-11511
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A SQL injection vulnerability was found in code-projects E-Commerce Website 1.0 in the file /pages/supplier_add.php. Manipulating the supp_email argument allows remote attack. The exploit has been publicly disclosed and may be used.
Risk Assessment
An attacker could manipulate SQL queries, potentially leading to unauthorized data access or corruption.
Recommendation
Apply patches, use parameterized queries, and restrict access to the application.
Other vulnerabilities in E-Commerce Website
See all- CVE-2025-11024Critical
There is an SQL injection vulnerability in Akilli Commerce software that allows for a Blind SQL Injection attack. This issue affects E-Commerce Website versions before 4.5.001.
- CVE-2025-11597Medium
A vulnerability was discovered in code-projects E-Commerce Website 1.0 involving SQL injection in the file /pages/product_add_qty.php. Manipulation of the prod_id argument allows remote attack execution. The exploit is publicly available and may be used.
- CVE-2025-11509Medium
A SQL injection vulnerability was found in code-projects E-Commerce Website 1.0 in the file /pages/product_add.php. Manipulating the prod_name argument allows remote attack. The exploit has been publicly disclosed and may be used.
Original NVD description (English source)
A flaw has been found in code-projects E-Commerce Website 1.0. Affected is an unknown function of the file /pages/supplier_add.php. Executing manipulation of the argument supp_email can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS