CVE-2025-14568

MediumCVSS 6.3

Published: 12/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

A security vulnerability has been detected in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. It affects an unknown function in model/User.php where manipulation of the `employee_id`, `id`, or `admin` arguments leads to SQL injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

Risk Assessment

A remote attacker can execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion in the database. Since the product is no longer supported, the risk remains high.

Recommendation

Discontinue use of this product or replace it with a supported solution, as no security updates are available. If that is not possible, isolate the system from the network and restrict access to it.

Other vulnerabilities in Stock-Management-System

CVE-2025-14567Medium
A weakness has been identified in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This affects an unknown function of the file /api/employees. Executing manipulation can lead to missing authentication. It is possible to launch the attack remotely, and the exploit has been made available to the public. This product takes the approach of rolling releases, and the vendor was contacted but did not respond. This vulnerability only affects products that are no longer supported by the maintainer.

Original NVD description (English source)

A security vulnerability has been detected in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This impacts an unknown function of the file model/User.php. The manipulation of the argument employee_id/id/admin leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS