CVE-2025-10786: Campcodes Grocery Sales and Inventory System ajax.php sql injection

Published Sep 22, 2025

Updated

A flaw has been found in Campcodes Grocery Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=deleteuser. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

Affected Software

2 affected components

Campcodes Grocery Sales and Inventory System

Campcodes Grocery Sales and Inventory System=1.0

Event History

Sep 22, 2025

CVE Published

via MITRE·06:32 AM

Data Sourced

via MITRE·06:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-10786?

CVE-2025-10786 has been classified as a high severity vulnerability due to its potential for remote SQL injection exploits.

How do I fix CVE-2025-10786?

To fix CVE-2025-10786, it is recommended to sanitize and validate user input for the ID parameter in the /ajax.php?action=delete_user function.

Who is affected by CVE-2025-10786?

CVE-2025-10786 affects users of Campcodes Grocery Sales and Inventory System version 1.0.

Can CVE-2025-10786 be exploited remotely?

Yes, CVE-2025-10786 can be exploited remotely, allowing attackers to perform SQL injection attacks.

What are the potential impacts of CVE-2025-10786?

The potential impacts of CVE-2025-10786 include unauthorized access to the database and manipulation of stored data.