CVE-2025-13260
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A SQL injection vulnerability has been found in Campcodes Supplier Management System 1.0 in the file /manufacturer/edit_product.php. Manipulation of the cmbProductUnit argument leads to SQL injection. The attack may be launched remotely, and the exploit has been disclosed.
Risk Assessment
A remote attacker can exploit the vulnerability to manipulate SQL queries, potentially leading to unauthorized data access or corruption. The public exploit increases the risk of attack.
Recommendation
Immediately update the system and apply patches. Also use parameterized SQL queries and restrict access to sensitive files.
Other vulnerabilities in Campcodes Supplier Management System
See all- CVE-2026-0597Medium
In Campcodes Supplier Management System 1.0, manipulation of the txtRetailerAddress argument in /retailer/edit_profile.php leads to SQL injection. The vulnerability can be exploited remotely and a public exploit has been released.
- CVE-2025-13424Medium
A vulnerability was found in Campcodes Supplier Management System 1.0 in /admin/add_product.php. Manipulating the txtProductName argument leads to SQL injection, and remote exploitation is possible. The exploit has been publicly disclosed and may be used.
- CVE-2025-13259Medium
A SQL injection vulnerability has been found in Campcodes Supplier Management System 1.0 in the file /manufacturer/edit_unit.php. Manipulation of the ID argument causes SQL injection. The attack may be initiated remotely, and the exploit has been published.
Original NVD description (English source)
A vulnerability has been found in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /manufacturer/edit_product.php. Such manipulation of the argument cmbProductUnit leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS