CVE-2025-13302
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability was identified in code-projects Courier Management System 1.0 allowing SQL injection in /add-new-officer.php. Manipulating the ManagerName argument enables remote attacks. The exploit is publicly available.
Risk Assessment
An attacker can exploit the vulnerability to gain unauthorized access to the database, steal data, or modify data. The public exploit increases the risk of attacks.
Recommendation
Immediately use parameterized SQL queries or prepared statements. Also update the system and monitor logs for SQL injection attempts.
Other vulnerabilities in Courier Management System
See all- CVE-2026-16229Medium
In Courier Management System up to version 1.0, a flaw exists in /index.php. Manipulation of the page parameter leads to cross-site scripting (XSS). The attack can be launched remotely, and an exploit has been published.
- CVE-2026-9607Medium
In itsourcecode Courier Management System 1.0, an unknown function in the file /parcel_list.php is vulnerable to SQL Injection via manipulation of the argument s. The attack can be performed remotely, and the exploit has been made public.
- CVE-2026-9606High
A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
- CVE-2025-13303Medium
A vulnerability was found in Courier Management System 1.0 in the file /search-edit.php. Manipulation of the Consignment argument leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2025-11553Medium
A weakness has been identified in code-projects Courier Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-courier.php. Executing manipulation of the argument Shippername can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.
Original NVD description (English source)
A vulnerability was identified in code-projects Courier Management System 1.0. This affects an unknown part of the file /add-new-officer.php. Such manipulation of the argument ManagerName leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS