Is there a public PoC exploit available for CVE-2025-11552?

Yes, a public proof-of-concept exploit is available for CVE-2025-11552. Prioritise patching immediately. EPSS: 0.0%.

Online Complaint Site CVE-2025-11552

Q: What is the CVSS score of CVE-2025-11552?

CVE-2025-11552 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-09 cna@vuldb.com

PHP SQLi Online Complaint Site Fabian

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:04 vuln.today

DescriptionCVE.org

A vulnerability was identified in code-projects Online Complaint Site 1.0. This impacts an unknown function of the file /admin/category.php. Such manipulation of the argument Category leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /admin/category.php, with publicly available exploit code. CVSS score of 2.1 reflects limited confidentiality impact and requirement for low-privilege authentication; EPSS of 0.03% indicates very low real-world exploitation probability despite public POC availability.

Technical ContextAI

The vulnerability exists in a PHP web application at the /admin/category.php endpoint, where user-supplied input from the Category parameter is directly incorporated into SQL queries without proper sanitization or parameterized query preparation. This is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which encompasses injection attacks where untrusted input flows directly into SQL contexts. The affected product is code-projects Online Complaint Site version 1.0, a complaint management application accessible via the CPE identifier cpe:2.3:a:fabian:online_complaint_site:1.0.

RemediationAI

Contact the vendor (fabian / code-projects.org) to request a security patch for version 1.0. If an updated version is released, upgrade immediately. Until patching is available, implement the following compensating controls: (1) Restrict access to /admin/category.php to trusted administrator IP addresses via firewall or web server access control lists - this eliminates remote exploitation risk while retaining functionality for authorized administrators; (2) Apply input validation and output encoding at the application level by converting the Category parameter through a whitelist of allowed values before use in SQL queries, or better yet, convert all SQL queries in category.php to parameterized prepared statements with bound parameters; (3) Reduce authentication scope by auditing and limiting which user accounts have low-privilege admin access to the category management function. The primary mitigation is code-level remediation, as the SQL injection itself stems from inadequate input handling rather than configuration.