What is the CVSS score of CVE-2025-65336?

CVE-2025-65336 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Fruits Bazar are affected by CVE-2025-65336?

Fruits Bazar ecommerce platform version 1.0 contains an unauthenticated SQL injection vulnerability that could allow any internet-connected attacker to steal customer data, modify transaction…

How to fix or mitigate CVE-2025-65336?

Within 24 hours, identify all instances of Fruits Bazar 1.0 in your environment and verify whether the /show_price_by_pdtId.php endpoint is internet-accessible; immediately notify affected system owners. Within 7 days, deploy Web Application Firewall rules to block SQL injection patterns in the product-ID parameter, require application teams to refactor the vulnerable code to use parameterized statements, and configure database accounts with minimum required privileges. Within 30 days, develop and execute an upgrade or replacement plan for the ecommerce platform, as no vendor patch is available for version 1.0.

Fruits Bazar CVE-2025-65336

EUVD-2025-210561 CRITICAL

SQL Injection (CWE-89)

2026-07-30 mitre

GHSA-fc42-f82g-cg8q

PHP SQLi N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network injection in a public endpoint (AV:N/AC:L/PR:N/UI:N); SQLi over the full database yields High confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:27 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 30, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 30, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.

AnalysisAI

SQL injection in the Fruits Bazar PHP/MySQLi ecommerce project 1.0 lets remote attackers inject arbitrary SQL through the product-ID parameter of /show_price_by_pdtId.php, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) allowing unauthenticated exploitation. The flaw carries a 9.8 critical score with full confidentiality, integrity, and availability impact, though its EPSS probability is only 0.15% (5th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is 'Ecommerce-project-with-php-and-mysqli-Fruits-Bazar,' a small open-source PHP shopping-cart application that uses the MySQLi extension to query a MySQL backend. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the product-ID input handled by /show_price_by_pdtId.php is concatenated directly into a MySQLi query without parameterization or escaping. The provided CPE (cpe:2.3:a:n/a:n/a) is a placeholder with no meaningful vendor/product metadata, so exact CPE-based matching is not possible beyond the named project at version 1.0.

RemediationAI

No vendor-released patch identified at time of analysis, and no fix version is present in the input data. As specific compensating controls: rewrite the query in /show_price_by_pdtId.php to use MySQLi prepared statements with bound parameters (mysqli_prepare / bind_param) so the pdtId value can never alter query structure - this is the definitive fix and has no functional side effect; as an interim measure cast the pdtId parameter to an integer (intval) since it is a product ID, which blocks injection but will reject any non-numeric IDs; and place the endpoint behind a WAF rule filtering SQL metacharacters or restrict/remove access to /show_price_by_pdtId.php, accepting that a WAF may be bypassable and that removing the endpoint breaks price-lookup functionality. Monitor the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-65336) and the project repository for an official patched release before relying on upstream code.