CVE-2025-14247
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability was found in Simple Shopping Cart 1.0 by code-projects in some unknown processing of the file /Admin/additems.php. Manipulation of the argument item_name leads to SQL injection. The attack can be executed remotely and the exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely manipulate SQL queries, potentially leading to unauthorized database access, data theft, or modification. The organization may suffer severe losses.
Recommendation
It is recommended to apply patches immediately and use parameterized queries to prevent SQL injection. Also restrict access to the /Admin/additems.php file.
Other vulnerabilities in Simple Shopping Cart
See all- CVE-2026-48868High
Versions of Simple Shopping Cart <= 5.2.9 are vulnerable to unauthenticated Insecure Direct Object References (IDOR). This allows attackers to access resources they should not have access to.
- CVE-2026-0552Medium
Stored Cross-Site Scripting (XSS) vulnerability in WordPress Simple Shopping Cart plugin up to version 5.2.4. Through the 'wpsc_display_product' shortcode and user-supplied attributes, attackers with contributor-level access or higher can inject arbitrary scripts that execute when a page is visited.
- CVE-2025-14246Medium
A vulnerability was found in Simple Shopping Cart 1.0 by code-projects in unknown code of the file /Customers/settings.php. Manipulation of the argument user_id results in SQL injection. Remote exploitation is possible and the exploit has been made public.
Original NVD description (English source)
A vulnerability was determined in code-projects Simple Shopping Cart 1.0. This issue affects some unknown processing of the file /Admin/additems.php. Executing manipulation of the argument item_name can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS