CVE-2025-15211
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A flaw has been found in code-projects Refugee Food Management System 1.0. It impacts an unknown function in the file /home/refugee.php. Manipulation of arguments refNo/Fname/Lname/sex/age/contact/nationality_nid can lead to SQL injection. The attack can be executed remotely, and the exploit has been published.
Risk Assessment
The organization may be exposed to SQL injection, potentially allowing an attacker to manipulate the database, steal data, or compromise system integrity.
Recommendation
It is recommended to apply patches or upgrade the system immediately, and to validate and sanitize input data to prevent SQL injection attacks.
Other vulnerabilities in Refugee Food Management System
See all- CVE-2025-15212Medium
A SQL injection vulnerability was detected in Refugee Food Management System 1.0 in the file /home/regfood.php. Manipulation of the 'a' argument allows SQL injection, and the attack can be performed remotely. The exploit is publicly available and may be used.
- CVE-2025-15210Medium
A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. It affects unknown code in the file /home/editrefugee.php. Manipulation of arguments a/b/c/sex/d/e/nationality_nid leads to SQL injection. The attack may be launched remotely, and the exploit has been publicly disclosed.
- CVE-2025-15209Medium
A weakness has been identified in code-projects Refugee Food Management System 1.0. It affects an unknown part of the file /home/editfood.php. Manipulation of arguments a/b/c/d causes SQL injection. The attack may be initiated remotely, and the exploit has been made available to the public.
Original NVD description (English source)
A flaw has been found in code-projects Refugee Food Management System 1.0. Impacted is an unknown function of the file /home/refugee.php. Executing manipulation of the argument refNo/Fname/Lname/sex/age/contact/nationality_nid can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS