CVE-2025-51972
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A SQL Injection vulnerability exists in login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of the 'keyword' POST parameter.
Risk Assessment
An attacker can gain unauthorized access to the database, steal, modify, or delete data, potentially leading to confidentiality and integrity breaches.
Recommendation
Use parameterized queries or prepared statements in login.php. Additionally, validate and sanitize all input data.
Other vulnerabilities in PuneethReddyHC Online Shopping System
See all- CVE-2025-51969Medium
A SQL Injection vulnerability exists in product.php of PuneethReddyHC Online Shopping System Advanced 1.0. The 'product_id' GET parameter is not properly validated before being included in a SQL statement.
- CVE-2025-51968Medium
A SQL Injection vulnerability exists in action.php of PuneethReddyHC Online Shopping System Advanced 1.0. The application fails to properly sanitize the 'proId' POST parameter, allowing attackers to inject arbitrary SQL expressions.
Original NVD description (English source)
A SQL Injection vulnerability exists in the login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input in the keyword POST parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS