Which versions of PHP are affected by EUVD-2025-21046?

A publicly disclosed SQL injection vulnerability exists in LifeStyle Store 1.0 that allows remote attackers to compromise database integrity and access sensitive data through the /success.php…

Is there a public PoC exploit available for EUVD-2025-21046?

Yes, a public proof-of-concept exploit is available for EUVD-2025-21046. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2025-21046?

Within 24 hours: Isolate affected LifeStyle Store 1.0 instances from production traffic or take the application offline; notify security team and relevant stakeholders. Within 7 days: Implement Web Application Firewall (WAF) rules blocking malicious ID parameter payloads to /success.php; conduct database audit for unauthorized access; review access logs for exploitation attempts. Within 30 days: Either upgrade to a patched version when available or decommission the application; perform comprehensive security assessment and penetration testing; restore any compromised data from clean backups.

PHP EUVD-2025-21046

Q: What is the CVSS score of EUVD-2025-21046?

EUVD-2025-21046 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2025-7411 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-10 cna@vuldb.com

PHP SQLi Lifestyle Store Anisha

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 06:52 euvd

EUVD-2025-21046

Analysis Generated

Mar 16, 2026 - 06:52 vuln.today

PoC Detected

Jul 16, 2025 - 15:02 vuln.today

Public exploit code

CVE Published

Jul 10, 2025 - 19:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects LifeStyle Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /success.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7411 is a critical SQL injection vulnerability in code-projects LifeStyle Store 1.0 affecting the /success.php endpoint's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially read/modify sensitive data. Public exploit code is available and the vulnerability is likely actively exploited in the wild, making this a high-priority remediation target despite the moderate CVSS 7.3 score which reflects limited immediate system impact rather than true severity.

Technical ContextAI

This vulnerability represents a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection') SQL injection flaw in PHP-based e-commerce software. The /success.php file fails to properly sanitize or parameterize the 'ID' parameter before incorporation into SQL queries, likely during order confirmation or transaction processing workflows. The affected product LifeStyle Store 1.0 is a PHP/MySQL-based e-commerce application from code-projects. The vulnerability exploits insufficient input validation in server-side request handling, bypassing database query protection mechanisms.

RemediationAI

Immediate actions: (1) Apply input validation: implement parameterized prepared statements using mysqli_prepare() or PDO prepared statements to eliminate SQL injection, (2) Code fix example—replace direct concatenation in /success.php with prepared statements: $stmt = $conn->prepare('SELECT * FROM orders WHERE id = ?'); $stmt->bind_param('i', $_GET['ID']); $stmt->execute();, (3) Input sanitization: whitelist/validate ID parameter as integer-only using intval() or type casting, (4) Web Application Firewall (WAF) rule: deploy ModSecurity or similar to block SQL metacharacters in GET parameters, (5) No official patch identified—contact code-projects maintainers immediately or migrate to maintained fork if available. Workaround: Restrict /success.php access via authentication token validation until patched.