CVE-2025-65354

Critical

Published: 23/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Improper input handling in /Grocery/search_products_itname.php in PuneethReddyHC event-management 1.0 permits SQL injection via the sitem_name POST parameter. Crafted payloads can alter query logic and disclose database contents. Exploitation may result in sensitive data disclosure and backend compromise.

Risk Assessment

The risk includes disclosure of sensitive database contents and potential backend compromise, potentially leading to system and data integrity breaches.

Recommendation

Immediately implement input validation and parameterized SQL queries in search_products_itname.php and update the application to the latest version if available.

Original NVD description (English source)

Improper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management 1.0 permits SQL injection via the sitem_name POST parameter. Crafted payloads can alter query logic and disclose database contents. Exploitation may result in sensitive data disclosure and backend compromise.