CVE-2025-61455

SQL Injection vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the signup.inc.php endpoint. The application directly incorporates unsanitized user inputs into SQL queries, allowing unauthenticated attackers to bypass authentication and gain full access.

Affected products

Bhabishya-123 E-Commerce

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

0.5% (43th percentile)

Weakness

CWE-89

NVD status

Deferred

Published

2025-10-20