CVE-2025-11396: code-projects Simple Food Ordering System product.php sql injection

Published Oct 7, 2025

Updated

A vulnerability was identified in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /product.php. Such manipulation of the argument Category leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

Affected Software

2 affected components

Code-projects Simple Food Ordering System

Fabian Simple Food Ordering System=1.0

Event History

Oct 7, 2025

CVE Published

via MITRE·01:02 PM

Data Sourced

via MITRE·01:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-11396?

CVE-2025-11396 has a high severity due to the potential for remote SQL injection attacks.

How do I fix CVE-2025-11396?

To fix CVE-2025-11396, validate and sanitize all user inputs to the /product.php file to prevent SQL injection.

What systems are affected by CVE-2025-11396?

CVE-2025-11396 affects code-projects Simple Food Ordering System version 1.0.

Can CVE-2025-11396 be exploited remotely?

Yes, CVE-2025-11396 can be exploited remotely by manipulating the Category argument.

What consequences can arise from CVE-2025-11396?

Exploitation of CVE-2025-11396 can lead to unauthorized access to the database and potential data leakage.