CVE-2025-9701

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

A vulnerability was determined in SourceCodester Simple Cafe Billing System 1.0. The impacted element is an unknown function of the file /receipt.php. Executing manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Simple Cafe Billing System	1.0

References

https://github.com/0510green-hand/cve/issues/4Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.321923Permissions Required, VDB Entry
https://vuldb.com/?id.321923Third Party Advisory, VDB Entry
https://vuldb.com/?submit.639216Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product
https://github.com/0510green-hand/cve/issues/4Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Aug 30, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-97029.8A vulnerability was identified in SourceCodester Simple Cafe Billing System 1.0. This affects an unknown function of the file /sales_report.CVE-2025-97034.3The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file cont CVE-2025-97049.8A security flaw has been discovered in SourceCodester Water Billing System 1.0. This impacts an unknown function of the file /viewbill.php. CVE-2025-97059.8A weakness has been identified in SourceCodester Water Billing System 1.0. Affected is an unknown function of the file /paybill.php. This ma CVE-2025-97069.8A security vulnerability has been detected in SourceCodester Water Billing System 1.0. Affected by this vulnerability is an unknown function CVE-2025-97086.8A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any CVE-2025-97098.6On-Chip Debug and Test Interface With Improper Access Control and Improper Protection against Electromagnetic Fault Injection (EM-FI) in Nor CVE-2025-97106.3The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attributes modifications, potentially allo CVE-2025-97117.8A vulnerability in Brocade Fabric OS before 9.2.1c3 could allow elevating the privileges of the local authenticated user to “root” using the CVE-2025-97128.8Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to CVE-2025-97138.8Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution.CVE-2025-97145.5Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow v