Simple Pizza Ordering System
Monthly
A security flaw has been discovered in code-projects Simple Pizza Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Simple Pizza Ordering System 1.0 enables remote attackers to manipulate the ID parameter of /editcus.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though no active exploitation has been reported, and EPSS predicts a low likelihood of widespread use.
SQL injection in Simple Pizza Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the ID parameter in the /large.php file to execute arbitrary SQL queries, potentially compromising data confidentiality, integrity, and availability. Public exploit code is available, though the EPSS score of 0.06% suggests low likelihood of widespread exploitation.
SQL injection in Simple Pizza Ordering System 1.0 allows remote attackers to manipulate database queries via the 'ID' parameter of /addpro.php. With no authentication or user interaction required, an attacker can read, modify, or delete data. Exploit code is publicly available but EPSS indicates a low probability of widespread exploitation.
CVE-2025-6483 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /edituser.php file's ID parameter. An unauthenticated remote attacker can exploit this weakness to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, increasing the likelihood of active exploitation.
CVE-2025-6482 is a SQL injection vulnerability in Simple Pizza Ordering System 1.0 affecting the /edituser-exec.php endpoint via the userid parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands and potentially exfiltrate, modify, or delete database contents. The vulnerability has been publicly disclosed with proof-of-concept exploitation available, presenting immediate risk to affected installations. With a CVSS score of 7.3 and network-based attack vector requiring no user interaction, this represents a moderately critical risk requiring urgent patching.
CVE-2025-6481 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the /update.php file's ID parameter, allowing unauthenticated remote attackers to manipulate database queries and potentially extract, modify, or delete sensitive data. The vulnerability has been publicly disclosed with proof-of-concept availability, significantly increasing exploitation risk in production environments. With a CVSS score of 7.3 and low attack complexity, this represents an immediate threat to any organization running the affected version without patches.
A SQL injection vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6479 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the /salesreport.php file parameter 'dayfrom'. An unauthenticated attacker can remotely execute arbitrary SQL queries with no user interaction required, potentially enabling data exfiltration, modification, or deletion. The vulnerability has been publicly disclosed with exploit proof-of-concept availability, increasing real-world exploitation risk.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6363 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /adding-exec.php file where the 'ingname' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. With a CVSS score of 7.3 and network-based attack vector requiring no user interaction, this vulnerability poses significant risk to affected deployments, though real-world exploitation likelihood depends on whether POC code and active exploitation attempts are documented.
CVE-2025-6362 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /editpro.php file where the ID parameter is improperly validated. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has a CVSS score of 7.3 (High) and requires no user interaction or authentication, making it a significant risk for deployments of this application.
CVE-2025-6361 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /adds.php file's userid parameter. An unauthenticated remote attacker can exploit this vulnerability without user interaction to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the application database. The vulnerability has a CVSS score of 7.3 (High) and represents an immediate risk to any organization running this unpatched system in production.
CVE-2025-6360 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /portal.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-6359 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /cashconfirm.php file where the 'transactioncode' parameter is unsanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-6358 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /saveorder.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, and system disruption. Public proof-of-concept code is available, increasing the immediate risk of active exploitation.
CVE-2025-6357 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /paymentportal.php file where the 'person' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability with no user interaction required to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing the likelihood of active exploitation.
CVE-2025-6356 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /addmem.php file that allows unauthenticated remote attackers to manipulate database queries. An attacker can exploit this vulnerability to read, modify, or delete sensitive data from the underlying database. The vulnerability has public exploit code available and may be actively exploited in the wild.
A security flaw has been discovered in code-projects Simple Pizza Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Simple Pizza Ordering System 1.0 enables remote attackers to manipulate the ID parameter of /editcus.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though no active exploitation has been reported, and EPSS predicts a low likelihood of widespread use.
SQL injection in Simple Pizza Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the ID parameter in the /large.php file to execute arbitrary SQL queries, potentially compromising data confidentiality, integrity, and availability. Public exploit code is available, though the EPSS score of 0.06% suggests low likelihood of widespread exploitation.
SQL injection in Simple Pizza Ordering System 1.0 allows remote attackers to manipulate database queries via the 'ID' parameter of /addpro.php. With no authentication or user interaction required, an attacker can read, modify, or delete data. Exploit code is publicly available but EPSS indicates a low probability of widespread exploitation.
CVE-2025-6483 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /edituser.php file's ID parameter. An unauthenticated remote attacker can exploit this weakness to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, increasing the likelihood of active exploitation.
CVE-2025-6482 is a SQL injection vulnerability in Simple Pizza Ordering System 1.0 affecting the /edituser-exec.php endpoint via the userid parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands and potentially exfiltrate, modify, or delete database contents. The vulnerability has been publicly disclosed with proof-of-concept exploitation available, presenting immediate risk to affected installations. With a CVSS score of 7.3 and network-based attack vector requiring no user interaction, this represents a moderately critical risk requiring urgent patching.
CVE-2025-6481 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the /update.php file's ID parameter, allowing unauthenticated remote attackers to manipulate database queries and potentially extract, modify, or delete sensitive data. The vulnerability has been publicly disclosed with proof-of-concept availability, significantly increasing exploitation risk in production environments. With a CVSS score of 7.3 and low attack complexity, this represents an immediate threat to any organization running the affected version without patches.
A SQL injection vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6479 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the /salesreport.php file parameter 'dayfrom'. An unauthenticated attacker can remotely execute arbitrary SQL queries with no user interaction required, potentially enabling data exfiltration, modification, or deletion. The vulnerability has been publicly disclosed with exploit proof-of-concept availability, increasing real-world exploitation risk.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6363 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /adding-exec.php file where the 'ingname' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. With a CVSS score of 7.3 and network-based attack vector requiring no user interaction, this vulnerability poses significant risk to affected deployments, though real-world exploitation likelihood depends on whether POC code and active exploitation attempts are documented.
CVE-2025-6362 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /editpro.php file where the ID parameter is improperly validated. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has a CVSS score of 7.3 (High) and requires no user interaction or authentication, making it a significant risk for deployments of this application.
CVE-2025-6361 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /adds.php file's userid parameter. An unauthenticated remote attacker can exploit this vulnerability without user interaction to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the application database. The vulnerability has a CVSS score of 7.3 (High) and represents an immediate risk to any organization running this unpatched system in production.
CVE-2025-6360 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /portal.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-6359 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /cashconfirm.php file where the 'transactioncode' parameter is unsanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-6358 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /saveorder.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, and system disruption. Public proof-of-concept code is available, increasing the immediate risk of active exploitation.
CVE-2025-6357 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /paymentportal.php file where the 'person' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability with no user interaction required to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing the likelihood of active exploitation.
CVE-2025-6356 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /addmem.php file that allows unauthenticated remote attackers to manipulate database queries. An attacker can exploit this vulnerability to read, modify, or delete sensitive data from the underlying database. The vulnerability has public exploit code available and may be actively exploited in the wild.