CVE-2025-14246
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability was found in Simple Shopping Cart 1.0 by code-projects in unknown code of the file /Customers/settings.php. Manipulation of the argument user_id results in SQL injection. Remote exploitation is possible and the exploit has been made public.
Risk Assessment
An attacker can remotely manipulate SQL queries, potentially leading to unauthorized access to user data or modification. The organization may be exposed to privacy breaches.
Recommendation
It is recommended to apply patches immediately and use parameterized queries to prevent SQL injection. Also restrict access to the /Customers/settings.php file.
Other vulnerabilities in Simple Shopping Cart
See all- CVE-2026-48868High
Versions of Simple Shopping Cart <= 5.2.9 are vulnerable to unauthenticated Insecure Direct Object References (IDOR). This allows attackers to access resources they should not have access to.
- CVE-2026-0552Medium
Stored Cross-Site Scripting (XSS) vulnerability in WordPress Simple Shopping Cart plugin up to version 5.2.4. Through the 'wpsc_display_product' shortcode and user-supplied attributes, attackers with contributor-level access or higher can inject arbitrary scripts that execute when a page is visited.
- CVE-2025-14247Medium
A vulnerability was found in Simple Shopping Cart 1.0 by code-projects in some unknown processing of the file /Admin/additems.php. Manipulation of the argument item_name leads to SQL injection. The attack can be executed remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was found in code-projects Simple Shopping Cart 1.0. This vulnerability affects unknown code of the file /Customers/settings.php. Performing manipulation of the argument user_id results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS