Which versions of Online Shopping Store are affected by EUVD-2025-18853?

Organizations using A vulnerability should be aware of moderate risk from CVE-2025-6484, a injection vulnerability rated CVSS 4.7.

Is there a public PoC exploit available for EUVD-2025-18853?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18853. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-18853?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Online Shopping Store EUVD-2025-18853

Q: What is the CVSS score of EUVD-2025-18853?

EUVD-2025-18853 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-6484 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-22 cna@vuldb.com

PHP SQLi Online Shopping Store Fabian

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.8 LOW

PR:H due to admin access required; C:L/I:L as SQLi can read/write limited data.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.7 (MEDIUM) 2.0 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 21:55 euvd

EUVD-2025-18853

Analysis Generated

Mar 15, 2026 - 21:55 vuln.today

PoC Detected

Jul 11, 2025 - 12:13 vuln.today

Public exploit code

CVE Published

Jun 22, 2025 - 17:15 cve.org

LOW 2.0

CVE Published

Jun 22, 2025 - 17:15 nvd

MEDIUM 4.7

DescriptionCVE.org

A vulnerability was found in code-projects Online Shopping Store 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /action.php. The manipulation of the argument cat_id/brand_id/keyword/proId/pid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Online Shopping Store 1.0 allows remote authenticated attackers to manipulate database queries via the cat_id, brand_id, keyword, proId, or pid parameters in /action.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.14%), indicating limited exploitation likelihood.

Technical ContextAI

The vulnerability is a SQL injection (CWE-74) in a PHP-based online shopping application. The affected file /action.php processes user-supplied parameters without proper sanitization, allowing an attacker to inject arbitrary SQL commands. The CPE indicates the product is Online Shopping Store version 1.0 by Fabian. The attack vector is network-based, requires high privileges (PR:H from CVSS 4.0), and has low complexity.

RemediationAI

No vendor-released patch identified at time of analysis. As a workaround, implement input validation and parameterized queries for all parameters in /action.php (cat_id, brand_id, keyword, proId, pid). Restrict access to /action.php to only authenticated administrators. Consider disabling the vulnerable functionality if not essential. Monitor for suspicious SQL queries in database logs.