CVE-2025-13571
published 2025-11-23CVE-2025-13571: A vulnerability was determined in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file…
PriorityP352high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.28%
19.4th percentile
A vulnerability was determined in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /listorder.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code-projects | simple_food_ordering_system | — | — |
| decidim | decidim | >= 0.30.0 < 0.30.4 | 0.30.4 |
| fabian | simple_cafe_ordering_system | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Decidim's private data exports can lead to data leaks
ghsa·2026-02-03
CVE-2025-65017 [HIGH] CWE-200 Decidim's private data exports can lead to data leaks
Decidim's private data exports can lead to data leaks
### Impact
Private data exports can lead to data leaks in cases where the UUID generation causes collisions for the generated UUIDs.
The bug was introduced by #13571 and affects Decidim versions 0.30.0 or newer (currently 2025-09-23).
This issue was discovered by running the following spec several times in a row, as it can randomly fail due to this bug:
```bash
$ cd decidim-core
$ for i in {1..10}; do bundle exec rspec spec/jobs/decidim/download_your_data_export_job_spec.rb -e "deletes the" || break ; done
```
Run the spec as many times as needed to hit a UUID that converts to `0` through `.to_i`.
The UUID to zero conversion does not cause a security issue but the security issue is demonstrated with the following example.
The fol
GHSA
GHSA-c6q3-g8x3-7xgf: A vulnerability was determined in code-projects Simple Food Ordering System 1
ghsa_unreviewed·2025-11-24
CVE-2025-13571 [MEDIUM] CWE-74 GHSA-c6q3-g8x3-7xgf: A vulnerability was determined in code-projects Simple Food Ordering System 1
A vulnerability was determined in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /listorder.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-23
Published