Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

origincode Product Catalog can be tricked to run database commands

CVE-2025-30524 · published 1 year ago
Summary

The Product Catalog feature in origincode versions up to 1.0.4 lets an attacker send specially crafted data that is passed to the database without proper checks. This could let them read, alter, or delete information stored in the system. Apply the latest security update from the vendor or restrict database access and validate all input fields.

Original advisory text
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in origincode Product Catalog displayproduct allows SQL Injection.This issue affects Product Catal...
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in origincode Product Catalog displayproduct allows SQL Injection.This issue affects Product Catalog: from n/a through <= 1.0.4.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published26 Mar 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-30524 · NVD
Track software like this
Free during beta