CVE-2025-11509: code-projects E-Commerce Website product_add.php sql injection

Published Oct 8, 2025

Updated

A vulnerability was detected in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/productadd.php. Performing manipulation of the argument prodname results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

Affected Software

2 affected components

Code-projects E-Commerce Website

Fabian E-commerce Website=1.0

Event History

Oct 8, 2025

CVE Published

via MITRE·10:32 PM

Data Sourced

via MITRE·10:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-11509?

CVE-2025-11509 is considered a high severity vulnerability due to the potential for SQL injection attacks.

How do I fix CVE-2025-11509?

To mitigate CVE-2025-11509, validate and sanitize user inputs in the prod_name parameter to prevent SQL injection.

What are the implications of exploiting CVE-2025-11509?

Exploiting CVE-2025-11509 could allow an attacker to manipulate the database through SQL injection, potentially leading to data leakage or manipulation.

Can CVE-2025-11509 be exploited remotely?

Yes, CVE-2025-11509 can be exploited remotely, making it critical for affected users to address the vulnerability promptly.

Which software is affected by CVE-2025-11509?

CVE-2025-11509 impacts the Code-projects E-Commerce Website version 1.0 due to a vulnerability in the /pages/product_add.php file.