CVE-2025-12300
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A weakness has been identified in code-projects Simple Food Ordering System 1.0 affecting unknown processing of the file /addcategory.php. Manipulation of the cname argument causes cross site scripting. The attack can be initiated remotely and the exploit has been made available to the public.
Risk Assessment
An attacker can remotely inject malicious script that executes in the victim's browser, potentially leading to session theft, redirections, or defacement. The public exploit increases the risk of exploitation.
Recommendation
Update the application to a version that fixes the vulnerability or apply input validation and sanitization for the cname argument. Implement CSP headers and monitor for unusual requests.
Other vulnerabilities in code-projects Simple Food Ordering System
See all- CVE-2025-11613Medium
A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in /addcategory.php. Manipulation of the cname argument allows remote attack. The exploit is publicly available.
- CVE-2025-11612Medium
A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in /addproduct.php. Manipulation of the Category argument allows remote attack. The exploit is publicly available.
- CVE-2025-11600Medium
A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in editcategory.php. Manipulation of the cname argument allows remote attack. The exploit is publicly available.
- CVE-2025-10837Low
A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /ordersimple/order.php. The manipulation of the argument ID leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Original NVD description (English source)
A weakness has been identified in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addcategory.php. This manipulation of the argument cname causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS