CVE-2025-14248

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

A vulnerability was identified in code-projects Simple Shopping Cart 1.0. Impacted is an unknown function of the file /adminlogin.php. The manipulation of the argument admin_username leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Simple Shopping Cart	1.0

References

https://code-projects.org/Product
https://github.com/zzb1388/cve/issues/92Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.334758Permissions Required, VDB Entry
https://vuldb.com/?id.334758Third Party Advisory, VDB Entry
https://vuldb.com/?submit.702464Third Party Advisory, VDB Entry
https://github.com/zzb1388/cve/issues/92Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Dec 8, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-142499.8A security flaw has been discovered in code-projects Online Ordering System 1.0. The affected element is an unknown function of the file /us CVE-2025-14254.7A Sudo privilege misconfiguration vulnerability in PocketBook InkPad Color 3 on Linux, ARM allows attackers to read file contents on the dev CVE-2025-142509.8A weakness has been identified in code-projects Online Ordering System 1.0. The impacted element is an unknown function of the file /user_co CVE-2025-142519.8A security vulnerability has been detected in code-projects Online Ordering System 1.0. This affects an unknown function of the file /admin/CVE-2025-142527.8An Improper Access Control vulnerability in Advantech SUSI driver (susi.sys) allows attackers to read/write arbitrary memory, I/O ports, and CVE-2025-142534.9Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit A CVE-2025-142546.5Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitr CVE-2025-142556.5Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitr CVE-2025-142569.8A vulnerability was detected in itsourcecode Student Management System 1.0. This impacts an unknown function of the file /newcurriculm.php. CVE-2025-142579.8A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /newrecord.php. Executing m CVE-2025-142589.8A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of CVE-2025-142596.3A vulnerability was found in Jihai Jshop MiniProgram Mall System 2.9.0. Affected by this issue is some unknown functionality of the file /in