CVE-2025-13202: code-projects Simple Cafe Ordering System add_to_cart cross site scripting

Published Nov 15, 2025

Updated

A security flaw has been discovered in code-projects Simple Cafe Ordering System 1.0. This affects an unknown part of the file /addtocart. Performing manipulation of the argument productname results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.

Affected Software

2 affected components

Code-projects Simple Cafe Ordering System

Fabian Simple Cafe Ordering System=1.0

Event History

Nov 15, 2025

CVE Published

via MITRE·05:02 PM

Data Sourced

via MITRE·05:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Sep 11, 58737

Event

via NVD·01:16 AM

Frequently Asked Questions

What is the severity of CVE-2025-13202?

CVE-2025-13202 has been assessed to have a moderate severity level due to the potential for cross-site scripting attacks.

How do I fix CVE-2025-13202?

To fix CVE-2025-13202, sanitize and validate the 'product_name' input to prevent injection of malicious scripts.

What systems are affected by CVE-2025-13202?

CVE-2025-13202 affects the Simple Cafe Ordering System version 1.0 by Code-projects.

Can CVE-2025-13202 be exploited remotely?

Yes, CVE-2025-13202 can be exploited remotely by manipulating the 'product_name' argument.

What types of attacks are possible with CVE-2025-13202?

CVE-2025-13202 can lead to cross-site scripting (XSS) attacks, allowing attackers to execute scripts in the context of the user's browser.