CVE-2025-12926
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A SQL injection vulnerability has been identified in SourceCodester Farm Management System 1.0 in the /review.php file via manipulation of the pid argument. The attack can be performed remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely manipulate SQL queries, potentially leading to unauthorized data access or modification. The publicly available exploit increases the risk of exploitation.
Recommendation
Apply patches immediately or restrict access to /review.php. Also use parameterized queries to prevent SQL injection.
Other vulnerabilities in SourceCodester Farm Management System
See all- CVE-2025-13200Medium
In SourceCodester Farm Management System 1.0, there is a vulnerability exposing information through directory listing. A remote attacker can exploit this to browse directory contents.
- CVE-2025-11487Medium
A SQL injection vulnerability was discovered in SourceCodester Farm Management System 1.0 in /uploadProduct.php. Manipulation of the Type argument allows remote attack execution. The exploit is publicly available.
- CVE-2025-11486Medium
A SQL injection vulnerability exists in SourceCodester Farm Management System 1.0 in /buyNow.php. Manipulation of the Name argument allows remote attack. The exploit is publicly available.
- CVE-2025-11478Medium
A SQL injection vulnerability was identified in SourceCodester Farm Management System 1.0 in the file /myCart.php. Manipulation of the pid argument leads to SQL injection, and remote exploitation is possible. The exploit has been made publicly available and could be exploited.
Original NVD description (English source)
A weakness has been identified in SourceCodester Farm Management System 1.0. The affected element is an unknown function of the file /review.php. This manipulation of the argument pid causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS