CVE-2025-13259
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A SQL injection vulnerability has been found in Campcodes Supplier Management System 1.0 in the file /manufacturer/edit_unit.php. Manipulation of the ID argument causes SQL injection. The attack may be initiated remotely, and the exploit has been published.
Risk Assessment
The vulnerability allows a remote attacker to execute unauthorized SQL queries, potentially leading to data breaches. The public exploit increases the risk of exploitation.
Recommendation
Update the system as soon as possible and apply patches. Also use parameterized SQL queries and restrict access to the /manufacturer/edit_unit.php file.
Other vulnerabilities in Campcodes Supplier Management System
See all- CVE-2026-0597Medium
In Campcodes Supplier Management System 1.0, manipulation of the txtRetailerAddress argument in /retailer/edit_profile.php leads to SQL injection. The vulnerability can be exploited remotely and a public exploit has been released.
- CVE-2025-13424Medium
A vulnerability was found in Campcodes Supplier Management System 1.0 in /admin/add_product.php. Manipulating the txtProductName argument leads to SQL injection, and remote exploitation is possible. The exploit has been publicly disclosed and may be used.
- CVE-2025-13260Medium
A SQL injection vulnerability has been found in Campcodes Supplier Management System 1.0 in the file /manufacturer/edit_product.php. Manipulation of the cmbProductUnit argument leads to SQL injection. The attack may be launched remotely, and the exploit has been disclosed.
Original NVD description (English source)
A flaw has been found in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /manufacturer/edit_unit.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS