---
id: CVE-2025-11611
title: A weakness has been identified in SourceCodester Simple Inventory System 1.0
summary: >-
  A weakness has been identified in SourceCodester Simple Inventory System 1.0.
  Impacted is an unknown function of the file /user.php. This manipulation of
  the argument uemail causes sql injection. The attack is possible to be carried
  out …
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-74
  - CWE-89
vendor: codeastro
product: simple_inventory_system
affected:
  - simple_inventory_system = 1.0
published: '2025-10-11'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T13:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-11611'
references:
  - url: 'https://github.com/yihaofuweng/cve/issues/53'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?ctiid.327938'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.327938'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.672660'
    label: cna@vuldb.com
  - url: 'https://www.sourcecodester.com/'
    label: cna@vuldb.com
  - url: 'https://github.com/yihaofuweng/cve/issues/53'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00343
epssPercentile: 0.27975
ingestedAt: '2026-10-01T18:55:42.296Z'
---

## Overview

A weakness has been identified in SourceCodester Simple Inventory System 1.0. Impacted is an unknown function of the file /user.php. This manipulation of the argument uemail causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

## Affected

- `simple_inventory_system = 1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.