CVE-2025-15209
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A weakness has been identified in code-projects Refugee Food Management System 1.0. It affects an unknown part of the file /home/editfood.php. Manipulation of arguments a/b/c/d causes SQL injection. The attack may be initiated remotely, and the exploit has been made available to the public.
Risk Assessment
The organization may be exposed to SQL injection, potentially allowing an attacker to gain unauthorized access to data or compromise system integrity.
Recommendation
It is recommended to apply patches or upgrade the system immediately, and to implement preventive measures against SQL injection attacks.
Other vulnerabilities in Refugee Food Management System
See all- CVE-2025-15212Medium
A SQL injection vulnerability was detected in Refugee Food Management System 1.0 in the file /home/regfood.php. Manipulation of the 'a' argument allows SQL injection, and the attack can be performed remotely. The exploit is publicly available and may be used.
- CVE-2025-15211Medium
A flaw has been found in code-projects Refugee Food Management System 1.0. It impacts an unknown function in the file /home/refugee.php. Manipulation of arguments refNo/Fname/Lname/sex/age/contact/nationality_nid can lead to SQL injection. The attack can be executed remotely, and the exploit has been published.
- CVE-2025-15210Medium
A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. It affects unknown code in the file /home/editrefugee.php. Manipulation of arguments a/b/c/sex/d/e/nationality_nid leads to SQL injection. The attack may be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A weakness has been identified in code-projects Refugee Food Management System 1.0. This affects an unknown part of the file /home/editfood.php. This manipulation of the argument a/b/c/d causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS