CVE-2025-15210
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. It affects unknown code in the file /home/editrefugee.php. Manipulation of arguments a/b/c/sex/d/e/nationality_nid leads to SQL injection. The attack may be launched remotely, and the exploit has been publicly disclosed.
Risk Assessment
The organization may be exposed to SQL injection, potentially allowing an attacker to modify data, gain unauthorized access, or compromise system security.
Recommendation
It is recommended to apply patches or upgrade the system immediately, and to implement input validation mechanisms.
Other vulnerabilities in Refugee Food Management System
See all- CVE-2025-15212Medium
A SQL injection vulnerability was detected in Refugee Food Management System 1.0 in the file /home/regfood.php. Manipulation of the 'a' argument allows SQL injection, and the attack can be performed remotely. The exploit is publicly available and may be used.
- CVE-2025-15211Medium
A flaw has been found in code-projects Refugee Food Management System 1.0. It impacts an unknown function in the file /home/refugee.php. Manipulation of arguments refNo/Fname/Lname/sex/age/contact/nationality_nid can lead to SQL injection. The attack can be executed remotely, and the exploit has been published.
- CVE-2025-15209Medium
A weakness has been identified in code-projects Refugee Food Management System 1.0. It affects an unknown part of the file /home/editfood.php. Manipulation of arguments a/b/c/d causes SQL injection. The attack may be initiated remotely, and the exploit has been made available to the public.
Original NVD description (English source)
A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. This vulnerability affects unknown code of the file /home/editrefugee.php. Such manipulation of the argument a/b/c/sex/d/e/nationality_nid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS