CVE-2025-12300
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A weakness has been identified in code-projects Simple Food Ordering System 1.0 affecting unknown processing of the file /addcategory.php. Manipulation of the cname argument causes cross site scripting. The attack can be initiated remotely and the exploit has been made available to the public.
Risk Assessment
An attacker can remotely inject malicious script that executes in the victim's browser, potentially leading to session theft, redirections, or defacement. The public exploit increases the risk of exploitation.
Recommendation
Update the application to a version that fixes the vulnerability or apply input validation and sanitization for the cname argument. Implement CSP headers and monitor for unusual requests.
Other vulnerabilities in code-projects Simple Food Ordering System
See all- CVE-2025-11613Medium
A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in /addcategory.php. Manipulation of the cname argument allows remote attack. The exploit is publicly available.
- CVE-2025-11612Medium
A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in /addproduct.php. Manipulation of the Category argument allows remote attack. The exploit is publicly available.
- CVE-2025-11600Medium
A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in editcategory.php. Manipulation of the cname argument allows remote attack. The exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addcategory.php. This manipulation of the argument cname causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS