CVE-2025-11612

HighCVSS 8.8/10Last modified Oct 8, 2026

Description

A vulnerability has been found in code-projects Simple Food Ordering System 1.0. This impacts an unknown function of the file /addproduct.php. The manipulation of the argument Category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Simple Food Ordering System	1.0

References

https://code-projects.org/Product
https://github.com/xmqaq/cve/issues/6Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.327942Permissions Required, VDB Entry
https://vuldb.com/?id.327942Third Party Advisory, VDB Entry
https://vuldb.com/?submit.672775Third Party Advisory, VDB Entry
https://github.com/xmqaq/cve/issues/6Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Oct 11, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-116138.8A vulnerability was found in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file /addcategory.php. Th CVE-2025-116149.8A vulnerability was identified in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown functionality of t CVE-2025-116159.8A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add_CVE-2025-116165.4A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when receiving ICMPv6 pack CVE-2025-116175.4A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when receiving a IPv6 packet CVE-2025-116184.3A missing validation check in FreeRTOS-Plus-TCP's UDP/IPv6 packet processing code can lead to an invalid pointer dereference when receiving CVE-2025-116198.8Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to CVE-2025-11627.5A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /\_pars CVE-2025-116207.2The Multiple Roles per User plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the CVE-2025-116218.1Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_princ CVE-2025-116227.8Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileg CVE-2025-116236.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data