CVE-2025-11610

MediumCVSS 6.3

Published: 11/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

25th percentile - higher than 25% of all known CVEs

Summary

A SQL injection vulnerability was found in SourceCodester Simple Inventory System 1.0 in /brand.php. Manipulation of the editBrandName argument allows remote attack. The exploit is publicly available.

Risk Assessment

An attacker can remotely inject SQL, potentially leading to unauthorized data access or modification. Public exploit increases risk.

Recommendation

Apply patches or restrict access to /brand.php. Use parameterized queries.

Other vulnerabilities in SourceCodester Simple Inventory System

CVE-2025-11611Medium
A SQL injection vulnerability was identified in SourceCodester Simple Inventory System 1.0, specifically in the /user.php file. Manipulation of the 'uemail' argument allows injection of malicious SQL code. The attack can be carried out remotely, and the exploit is publicly available.

Original NVD description (English source)

A security flaw has been discovered in SourceCodester Simple Inventory System 1.0. This issue affects some unknown processing of the file /brand.php. The manipulation of the argument editBrandName results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be exploited.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS