CVE-2025-12294

CWE-74CWE-89 — SQL Injection3 documents3 sources
Severity
5.1MEDIUM
EPSS
0.0%
top 92.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Sourcecodester Point OF SalesJanobe Point OF Sales
Timeline
PublishedOct 27

Description

A security flaw has been discovered in SourceCodester Point of Sales 1.0. Impacted is an unknown function of the file /delete_category.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
SourceCodester Point of Sales delete_category.php sql injection↗2025-10-27
▶
GHSA
GHSA-r6fg-m2vv-9gfg: A security flaw has been discovered in SourceCodester Point of Sales 1↗2025-10-27
▶
CVE-2025-12294 (MEDIUM CVSS 5.1) | A security flaw has been discovered | cvebase.io