CVE-2025-51969
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A SQL Injection vulnerability exists in product.php of PuneethReddyHC Online Shopping System Advanced 1.0. The 'product_id' GET parameter is not properly validated before being included in a SQL statement.
Risk Assessment
An attacker can manipulate SQL queries, potentially leading to unauthorized data access, modification, or deletion.
Recommendation
Use parameterized queries or prepared statements in product.php. Additionally, validate and sanitize input data.
Other vulnerabilities in PuneethReddyHC Online Shopping System
See all- CVE-2025-51972Medium
A SQL Injection vulnerability exists in login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of the 'keyword' POST parameter.
- CVE-2025-51968Medium
A SQL Injection vulnerability exists in action.php of PuneethReddyHC Online Shopping System Advanced 1.0. The application fails to properly sanitize the 'proId' POST parameter, allowing attackers to inject arbitrary SQL expressions.
Original NVD description (English source)
A SQL Injection vulnerability exists in the product.php page of PuneethReddyHC Online Shopping System Advanced 1.0. This flaw is present in the product_id GET parameter, which is not properly validated before being included in a SQL statement.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS