CVE-2025-11487 MEDIUM

CVE-2025-11487: SourceCodester Farm Management System uploadProduct.php sql injection

Vendor Sourcecodester

Product Farm Management System

Weakness CWE-89 · SQLi

Published October 8, 2025

Last update October 8, 2025

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A security flaw has been discovered in SourceCodester Farm Management System 1.0. Affected by this issue is some unknown functionality of the file /uploadProduct.php. Performing manipulation of the argument Type results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.

Key dates

02Disclosure timeline

October 8, 2025 CVE published

October 8, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-11487 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2026-13766 DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers CVE-2026-12090 Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter CVE-2026-13551 itsourcecode Baptism Information Management System editBaptism.php sql injection CVE-2026-13579 itsourcecode Hospital Management System patientchangepassword.php sql injection CVE-2026-13744 Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input