CVE-2025-15212
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A SQL injection vulnerability was detected in Refugee Food Management System 1.0 in the file /home/regfood.php. Manipulation of the 'a' argument allows SQL injection, and the attack can be performed remotely. The exploit is publicly available and may be used.
Risk Assessment
SQL injection may allow an attacker to read, modify, or delete database data, and in some cases execute commands on the server. Since the exploit is public, the risk of rapid exploitation is high.
Recommendation
Immediately audit /home/regfood.php and implement parameterized queries and input validation. It is also recommended to deploy WAF rules and monitor for attack attempts.
Other vulnerabilities in Refugee Food Management System
See all- CVE-2025-15211Medium
A flaw has been found in code-projects Refugee Food Management System 1.0. It impacts an unknown function in the file /home/refugee.php. Manipulation of arguments refNo/Fname/Lname/sex/age/contact/nationality_nid can lead to SQL injection. The attack can be executed remotely, and the exploit has been published.
- CVE-2025-15210Medium
A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. It affects unknown code in the file /home/editrefugee.php. Manipulation of arguments a/b/c/sex/d/e/nationality_nid leads to SQL injection. The attack may be launched remotely, and the exploit has been publicly disclosed.
- CVE-2025-15209Medium
A weakness has been identified in code-projects Refugee Food Management System 1.0. It affects an unknown part of the file /home/editfood.php. Manipulation of arguments a/b/c/d causes SQL injection. The attack may be initiated remotely, and the exploit has been made available to the public.
Original NVD description (English source)
A vulnerability was detected in code-projects Refugee Food Management System 1.0. This issue affects some unknown processing of the file /home/regfood.php. Performing manipulation of the argument a results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS