CVE-2025-63939

Critical

Published: 14 April 2026

Published

14 April 2026

Modified

17 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0027 18.3th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-63939 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-63939 is a high-severity SQL injection vulnerability stemming from improper input handling in the /Grocery/search_products_itname.php component of the anirudhkannan Grocery Store Management System version 1.0. The flaw allows attackers to inject malicious SQL code via the sitem_name POST parameter, as classified under CWE-89. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical risk due to its ease of exploitation and potential for severe impact.

Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By sending crafted POST requests to the affected endpoint, attackers can execute arbitrary SQL queries, potentially extracting sensitive data such as customer information, product details, or credentials from the backend database, as well as modifying or deleting records to disrupt operations.

For mitigation details, refer to the security advisory published at https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2025-63939, which was made available around the CVE's publication date of 2026-04-14. Practitioners should prioritize patching or upgrading the Grocery Store Management System and implementing input sanitization or prepared statements in custom deployments.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-209441

Vulnerability details

Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection via the sitem_name POST parameter.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in publicly accessible web endpoint (/search_products_itname.php) directly enables unauthenticated remote code execution against the application, matching T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0