← Vulnerability feed

Vulnerability record · CVE-2025-11552 · published 9 October 2025

CVE-2025-11552: Fabian online complaint site injection vulnerability

Fabian · Online Complaint Site

A vulnerability was identified in code-projects Online Complaint Site 1.0. This impacts an unknown function of the file /admin/category.php. Such manipulation of the argument Category leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

2.1 CVSS 4.0 Low EPSS 0.38% · top 70.6% CWE-74 · InjectionCWE-89 · SQL injection
2.1CVSS 4.0 base score, v2 6.5
0.38%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

A vulnerability was identified in code-projects Online Complaint Site 1.0. This impacts an unknown function of the file /admin/category.php. Such manipulation of the argument Category leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://code-projects.org/ Product
https://github.com/QuJun1/cve/issues/4 ExploitThird Party Advisory
https://vuldb.com/?ctiid.327711 Permissions RequiredVDB Entry
https://vuldb.com/?id.327711 Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.670285 Third Party AdvisoryVDB Entry

Track CVE-2025-11552 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-63622Fabian online complaint site sql injection vulnerabilityA vulnerability was found in code-projects Online Complaint Site 1.0. This issue affects some unknown processing of the file /cms/admin/subcategory.p…EPSS 0.33%2.1CVE-2025-11530Fabian online complaint site injection vulnerabilityA weakness has been identified in code-projects Online Complaint Site 1.0. Affected is an unknown function of the file /cms/admin/state.php. This man…EPSS 0.38%2.1CVE-2025-11514Fabian online complaint site injection vulnerabilityA vulnerability was identified in code-projects Online Complaint Site 1.0. This vulnerability affects unknown code of the file /cms/users/index.php. …EPSS 0.38%2.1CVE-2025-11515Fabian online complaint site injection vulnerabilityA security flaw has been discovered in code-projects Online Complaint Site 1.0. This issue affects some unknown processing of the file /cms/users/reg…EPSS 0.38%2.1CVE-2025-11516Fabian online complaint site injection vulnerabilityA weakness has been identified in code-projects Online Complaint Site 1.0. Impacted is an unknown function of the file /cms/users/complaint-details.p…EPSS 0.38%10.0CVE-2025-20337Cisco ISE API input validation flaw allows unauthenticated root RCECisco ISE and ISE-PIC fail to properly validate user-supplied input in a specific API, letting an unauthenticated remote attacker execute arbitrary c…KEVEPSS 68%analysed10.0CVE-2025-20281Cisco ISE API unauthenticated remote code executionCisco ISE and ISE-PIC fail to properly validate user-supplied input in a specific API, allowing a crafted request to reach the underlying operating s…KEVEPSS 98%analysed7.2CVE-2022-43769Hitachi Vantara Pentaho BA Server Spring Template InjectionHitachi Vantara Pentaho Business Analytics Server before 9.4.0.1 and 9.3.0.2, including 8.3.x, allows certain web services to set property values con…KEVEPSS 98%analysed

Source: NIST National Vulnerability Database (record CVE-2025-11552), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.