Vulnerability · Published Sep 23, 2025 · Assigned by VulDB
CVE-2025-10837code-projects Simple Food Ordering System order.php cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in Simple Food Ordering System from code-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /ordersimple/order.php. The manipulation of the argument ID leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| code-projects | Simple Food Ordering System | 1.0 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
References
- VDB-325194 | code-projects Simple Food Ordering System order.php cross site scripting vdb-entry, technical-description
- VDB-325194 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #657108 | code-projects Simple Food Ordering System 1.0 Improper Neutralization of Alternate XSS Syntax third-party-advisory
- https://github.com/asd1238525/cve/blob/main/xss3.md exploit
- https://code-projects.org/ product