CVE-2025-11600
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in editcategory.php. Manipulation of the cname argument allows remote attack. The exploit is publicly available.
Risk Assessment
An attacker can remotely inject SQL, potentially leading to unauthorized data access or modification. Public exploit increases risk.
Recommendation
Apply patches or restrict access to editcategory.php. Use parameterized queries.
Other vulnerabilities in code-projects Simple Food Ordering System
See all- CVE-2025-12300Medium
A weakness has been identified in code-projects Simple Food Ordering System 1.0 affecting unknown processing of the file /addcategory.php. Manipulation of the cname argument causes cross site scripting. The attack can be initiated remotely and the exploit has been made available to the public.
- CVE-2025-11613Medium
A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in /addcategory.php. Manipulation of the cname argument allows remote attack. The exploit is publicly available.
- CVE-2025-11612Medium
A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in /addproduct.php. Manipulation of the Category argument allows remote attack. The exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file editcategory.php. Such manipulation of the argument cname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS