HIGHCVSS 7.3Vulnerability

CVE-2025-14249

A security flaw has been discovered in code-projects Online Ordering System 1.0. The affected element is an unknown function of the file /user_school.php. The manipulation of the argument product_id results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited.

Properties

Severity: HIGH
Epss score: 0.00387
Cvss severity: HIGH
Cvss score: 7.3
Retrieved at: 2026-10-24T22:41:43+00:00
Last source: FIRST EPSS
Score: 7.3
Cve id: CVE-2025-14249
Cvss vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
First seen by Signal: 2026-10-07T22:34:45+00:00
Name: CVE-2025-14249
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Published at: 2025-12-08T15:15:49.890
Last modified: 2026-10-07T20:10:01.970
Epss percentile: 0.31692

Related Entities (3)

HAS_WEAKNESS (2)

→[Weakness]Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

→[Weakness]Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

AFFECTS_PRODUCT (1)

→[Product]fabian online ordering system 1.0

Explore deeper with Ninja Signal's threat intelligence graph

Search in Spektr Open Signal Desktop