CVE-2025-11558: code-projects E-Commerce Website user_index_search.php sql injection

Published Oct 9, 2025

Updated

A vulnerability was found in code-projects E-Commerce Website 1.0. Impacted is an unknown function of the file /pages/userindexsearch.php. Performing manipulation of the argument Search results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

Affected Software

2 affected components

Code-projects E-Commerce Website

Fabian E-commerce Website=1.0

Event History

Oct 9, 2025

CVE Published

via MITRE·09:02 PM

Data Sourced

via MITRE·09:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-11558?

CVE-2025-11558 has been categorized as a critical vulnerability due to the potential for remote SQL injection attacks.

How do I fix CVE-2025-11558?

To fix CVE-2025-11558, you should validate and sanitize input parameters in the affected /pages/user_index_search.php file.

What type of attack does CVE-2025-11558 allow?

CVE-2025-11558 allows attackers to perform SQL injection remotely through poor input handling in the application.

What software is affected by CVE-2025-11558?

CVE-2025-11558 affects the Code-projects E-Commerce Website version 1.0.

Can CVE-2025-11558 be exploited without authentication?

Yes, CVE-2025-11558 can be exploited remotely without the need for user authentication.