CVE-2025-7607 MEDIUM

CVE-2025-7607: code-projects Simple Shopping Cart save_order.php sql injection

Vendor Code-Projects

Product Simple Shopping Cart

Weakness CWE-89 · SQLi

Published July 14, 2025

Last update July 14, 2025

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability, which was classified as critical, has been found in code-projects Simple Shopping Cart 1.0. This issue affects some unknown processing of the file /Customers/save_order.php. The manipulation of the argument order_price leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

July 14, 2025 CVE published

July 14, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-7607 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2024-30241 WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.1 - Contributor+ SQL Injection vulnerability CVE-2024-12479 cjbi wetech-cms TopicDao.java searchTopicByKeyword sql injection CVE-2025-22533 WordPress WOOEXIM Plugin <= 5.0.0 - SQL Injection vulnerability CVE-2025-13272 Campcodes School Fees Payment Management System manage_course.php sql injection CVE-2026-42287 Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions