CVE-2025-10837
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /ordersimple/order.php. The manipulation of the argument ID leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Risk Assessment
Publicly available exploit increases the risk of attack. XSS could allow execution of malicious script in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Immediately apply a patch or update the system to a secure version. If not available, restrict access to the application and monitor logs.
Other vulnerabilities in code-projects Simple Food Ordering System
See all- CVE-2025-12300Medium
A weakness has been identified in code-projects Simple Food Ordering System 1.0 affecting unknown processing of the file /addcategory.php. Manipulation of the cname argument causes cross site scripting. The attack can be initiated remotely and the exploit has been made available to the public.
- CVE-2025-11613Medium
A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in /addcategory.php. Manipulation of the cname argument allows remote attack. The exploit is publicly available.
- CVE-2025-11612Medium
A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in /addproduct.php. Manipulation of the Category argument allows remote attack. The exploit is publicly available.
- CVE-2025-11600Medium
A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in editcategory.php. Manipulation of the cname argument allows remote attack. The exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /ordersimple/order.php. The manipulation of the argument ID leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS