CVE-2025-15073

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

A vulnerability was determined in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /contact_us.php. This manipulation of the argument Name causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Online Frozen Foods Ordering System	1.0

References

https://github.com/24ggee/CVE/issues/1Exploit, Issue Tracking
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.338330Permissions Required, VDB Entry
https://vuldb.com/?id.338330Third Party Advisory, VDB Entry
https://vuldb.com/?submit.721321Third Party Advisory, VDB Entry

Timeline

Published: Dec 24, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-150749.8A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file CVE-2025-150759.8A security flaw has been discovered in itsourcecode Student Management System 1.0. This issue affects some unknown processing of the file /s CVE-2025-150767.3A weakness has been identified in Tenda CH22 1.0.0.1. Impacted is an unknown function of the file /public/. Executing a manipulation can lea CVE-2025-150779.8A security vulnerability has been detected in itsourcecode Student Management System 1.0. The affected element is an unknown function of the CVE-2025-150789.8A vulnerability was detected in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /list_re CVE-2025-150795.3When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting CVE-2025-15085.3The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data CVE-2025-150808.8Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R1 CVE-2025-150816.3A vulnerability has been found in JD Cloud BE6500 4.4.1.r4308. This issue affects the function sub_4780 of the file /jdcapi. Such manipulati CVE-2025-150827.5A vulnerability was found in TOZED ZLT M30s up to 1.47. Impacted is an unknown function of the file /reqproc/proc_post of the component Web CVE-2025-150834.6A vulnerability was determined in TOZED ZLT M30s up to 1.47. The affected element is an unknown function of the component UART Interface. Ex CVE-2025-150843.1A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file