CVE-2025-11553
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A weakness has been identified in code-projects Courier Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-courier.php. Executing manipulation of the argument Shippername can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.
Risk Assessment
The risk includes the possibility of SQL injection, which could lead to unauthorized database access, data theft, modification, or deletion. The publicly available exploit increases the likelihood of attack.
Recommendation
It is recommended to immediately apply patches or system updates if available. Input validation and sanitization should also be performed in the /add-courier.php file, and access to the system should be restricted.
Other vulnerabilities in Courier Management System
See all- CVE-2026-16229Medium
In Courier Management System up to version 1.0, a flaw exists in /index.php. Manipulation of the page parameter leads to cross-site scripting (XSS). The attack can be launched remotely, and an exploit has been published.
- CVE-2026-9607Medium
In itsourcecode Courier Management System 1.0, an unknown function in the file /parcel_list.php is vulnerable to SQL Injection via manipulation of the argument s. The attack can be performed remotely, and the exploit has been made public.
- CVE-2026-9606High
A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
- CVE-2025-13303Medium
A vulnerability was found in Courier Management System 1.0 in the file /search-edit.php. Manipulation of the Consignment argument leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2025-13302Medium
A vulnerability was identified in code-projects Courier Management System 1.0 allowing SQL injection in /add-new-officer.php. Manipulating the ManagerName argument enables remote attacks. The exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in code-projects Courier Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-courier.php. Executing manipulation of the argument Shippername can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS