Critical severity · published Sep 26, 2025
CVE-2025-11037
code-projects E-Commerce Website admin_index_search.php sql injection
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
A security flaw has been discovered in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/admin_index_search.php. Performing manipulation of the argument Search results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EW
E-Commerce Website · code-projects
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11037
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11037
Product
https://code-projects.org/
Exploit
https://github.com/aCas1o/cve_report04/blob/main/report.md
Permissions Required
https://vuldb.com/?ctiid.325984
Third Party Advisory
https://vuldb.com/?id.325984
Third Party Advisory
https://vuldb.com/?submit.658275
More from E-Commerce Website
9.8
CVE-2025-11597
code-projects E-Commerce Website product_add_qty.php sql injection
9.8
CVE-2025-11596
code-projects E-Commerce Website delete_order_details.php sql injection
9.8
CVE-2025-11558
code-projects E-Commerce Website user_index_search.php sql injection
9.8
CVE-2025-11513
code-projects E-Commerce Website supplier_update.php sql injection
9.8
CVE-2025-11511
code-projects E-Commerce Website supplier_add.php sql injection