EUVD-2025-18477Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 7.3. EPSS 0.1%. Public PoC/exploit available. No patch confirmed. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability in the affected application to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
A remote code execution vulnerability (CVSS 7.3). Risk factors: public PoC available.
Earlier versions of this analysis (1)
A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown function of the file /editproduct.php. The manipulation of the ar
RemediationAI
Monitor vendor channels for patch availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-284 (Improper Access Control). CVSS 7.3 indicates high severity.
Know when Simple Food Ordering System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown function of the file /editproduct.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
A critical file upload vulnerability in Simple Food Ordering System 1.0 allows unauthenticated attackers to upload arbitrary files remotely, potentially leading to system compromise, data theft, and service disruption. Organizations running this application face immediate risk of code execution and unauthorized access to customer and business data.
Implement Web Application Firewall (WAF) rules to block POST requests to /editproduct.php; restrict access to /editproduct.php by IP whitelist; disable file upload functionality if not critical; enforce strict file type validation (whitelist only images); isolate affected systems on a segmented network; implement file integrity monitoring on upload directories; enable verbose logging and alerting for upload attempts; execute regular malware scans on upload directories; consider disabling the entire product editing feature until patched.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
More in Simple Food Ordering System
View allA vulnerability was found in SourceCodester Simple Food Ordering System 1.0. Rated medium severity (CVSS 5.4), this vuln
Price parameter manipulation in SourceCodester Simple Food Ordering System 1.0 allows unauthenticated remote attackers t
Unrestricted file upload in Simple Food Ordering System 1.0 (PHP) allows remote attackers to upload arbitrary files thro
Unrestricted file upload in code-projects Simple Food Ordering System 1.0 allows remote attackers to upload arbitrary fi
The Simple Food Ordering System through version 1.0 allows unauthenticated remote attackers to access sensitive database
SQL injection in code-projects Simple Food Ordering System 1.0 allows remote unauthenticated attackers to manipulate dat
A vulnerability, which was classified as problematic, was found in SourceCodester Simple Food Ordering System 1.0. Rated
A vulnerability has been found in code-projects Simple Food Ordering System 1.0. Rated medium severity (CVSS 5.3), this
Cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts via un
Stored cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts
Stored cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts
Reflected cross-site scripting (XSS) in Simple Food Ordering System 1.0 via the pname parameter in /editcategory.php all
Exploit-DB