Critical severity · published Oct 9, 2025
CVE-2025-11558
code-projects E-Commerce Website user_index_search.php sql injection
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was found in code-projects E-Commerce Website 1.0. Impacted is an unknown function of the file /pages/user_index_search.php. Performing manipulation of the argument Search results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EW
E-Commerce Website · code-projects
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11558
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11558
Product
https://code-projects.org/
Exploit
https://github.com/cxm947/CVE-repoort-251008
Permissions Required
https://vuldb.com/?ctiid.327718
Third Party Advisory
https://vuldb.com/?id.327718
Third Party Advisory
https://vuldb.com/?submit.671451
More from E-Commerce Website
9.8
CVE-2025-11597
code-projects E-Commerce Website product_add_qty.php sql injection
9.8
CVE-2025-11596
code-projects E-Commerce Website delete_order_details.php sql injection
9.8
CVE-2025-11513
code-projects E-Commerce Website supplier_update.php sql injection
9.8
CVE-2025-11511
code-projects E-Commerce Website supplier_add.php sql injection
9.8
CVE-2025-11509
code-projects E-Commerce Website product_add.php sql injection