CVE-2025-13290 — Injection in Simple Food Ordering System

CWE-74 — Injection CWE-89 — SQL Injection3 documents3 sources

Severity

5.3MEDIUMNVD

EPSS

0.0%

top 94.89%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Code-projects Simple Food Ordering System Fabian Simple Food Ordering System

Timeline

PublishedNov 17

Description

A vulnerability has been found in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /saveorder.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5code-projects/simple_food_ordering_system1.0

▶NVDfabian/simple_food_ordering_system1.0

🔴Vulnerability Details

GHSA

GHSA-j5g5-hr46-7r77: A vulnerability has been found in code-projects Simple Food Ordering System 1↗2025-11-17

▶

CVEList

code-projects Simple Food Ordering System saveorder.php sql injection↗2025-11-17

▶