CVE-2025-14832

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was identified in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /updateproduct.php?action=edit. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Online Cake Ordering System	1.0

References

https://github.com/ZhangYu-del/cve/issues/1Exploit, Issue Tracking, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.336981Permissions Required, VDB Entry
https://vuldb.com/?id.336981Third Party Advisory, VDB Entry
https://vuldb.com/?submit.715063Third Party Advisory, VDB Entry
https://github.com/ZhangYu-del/cve/issues/1Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Dec 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-148339.8A security flaw has been discovered in code-projects Online Appointment Booking System 1.0. The impacted element is an unknown function of t CVE-2025-148348.8A weakness has been identified in code-projects Simple Stock System 1.0. This affects an unknown function of the file /checkuser.php. Execut CVE-2025-148357.1The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions u CVE-2025-148362.7A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the compon CVE-2025-148377.2A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the compo CVE-2025-14846.5A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploited an attacker could CVE-2025-148407.5Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects CVE-2025-148413.3A flaw has been found in OFFIS DCMTK up to 3.6.9. The impacted element is the function DcmQueryRetrieveIndexDatabaseHandle::startFindRequest CVE-2025-148426.1The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type CVE-2025-148435.3The Wizit Gateway for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Order Cancellation in all versions up to, CVE-2025-148447.5The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, CVE-2025-148454.3The NS IE Compatibility Fixer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including,