CVE Intelligence
Analysis AI-assisted

CVE-2025-11431: code-projects Web-Based Inventory and POS System SQL injection in transaction.php

A SQL injection weakness (CWE-89) was reported in the transaction.php file of code-projects Web-Based Inventory and POS System 1.0. It is triggered through the shopid argument and can be reached remotely. The NVD rates it critical with a CVSS 3.1 base score of 9.8, and the record states that a public exploit has been disclosed, while no fixed version is listed and the CVE is not in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an SQL injection issue (CWE-89) in the transaction.php file of code-projects Web-Based Inventory and POS System 1.0. The weakness is triggered by manipulating the shopid argument. VulDB is the CNA for the entry, and the NVD scores it as critical.

Impact

  • The NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with a base score of 9.8 indicates a network attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity and availability.
  • SQL injection can in general allow unauthorized reading or modification of database content. The exact effects in this application are not described in the record.

Affected products and versions

  • Code-projects Web-Based Inventory and POS System, version 1.0.
  • Fabian Web-based Inventory And Pos System, version 1.0, listed as a second affected product name in the record.
  • No other versions are listed. Check the project homepage for version information.

Exploitation status

  • The record states that the exploit has been publicly disclosed and may be utilized. Its SSVC exploitation value is poc (proof of concept) and its automatable value is no.
  • This CVE is not listed in CISA KEV, so no confirmed active exploitation appears in the sources consulted.
  • The EPSS probability is 0.00398 with a percentile of 0.32179.

Remediation and mitigation

  • No fixed version is listed in the record. The absence of a listed fix does not mean none exists, so the fix status is unknown.
  • Restrict remote access to the application, keeping it off public networks where possible and behind authentication.
  • Ask the vendor or project maintainers for a corrected release. If you maintain the code, apply input validation and parameterized queries.
  • Review the database account privileges used by the application and apply least privilege.

Detection guidance

  • Review web server and application logs for unusual or malformed values in the shopid parameter on requests to transaction.php.
  • Monitor database errors originating from the transaction page.
  • A web application firewall may help flag SQL syntax patterns, but it does not replace a code fix.

Limitations of the available information

  • The record does not identify the affected code lines, fixed versions, or any vendor advisory response.
  • The vendor link in the record points to the project homepage; the record does not confirm a security advisory from the project.
  • The record lists a second product name that differs from the first; it is unclear whether both refer to the same codebase.
  • The EPSS date in the record (2026-10-13) is later than the publication date and should be verified against the source.

Frequently asked questions

Is this CVE being actively exploited?

CISA KEV does not list this CVE, so no confirmed active exploitation appears in the sources consulted. The record does state that a public exploit has been disclosed and may be used.

Is a fixed version available?

No fixed version is listed in the record. Treat the fix status as unknown and check with the vendor or project maintainers for an update.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.