CVE-2025-14780

A vulnerability was detected in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761. The affected element is an unknown function of the file /dishtrade/dish_trade_detail_get. The manipulation of the argument filter results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

• CWE-74
• CWE-89

• https://github.com/zhangbuneng/3/issues/1
• https://vuldb.com/?ctiid.336607
• https://vuldb.com/?id.336607
• https://vuldb.com/?submit.674051

Published

Dec 16, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14773Improper neutralization of input during web page generation …5.4
• CVE-2025-14774Incorrect Authorization vulnerability in ABB T-MAC Plus. Th…7.4
• CVE-2025-14777A flaw was found in Keycloak. An IDOR (Broken Access Control…6
• CVE-2025-14778A flaw was found in Keycloak. A significant Broken Access Co…5.4
• CVE-2025-14779The Secret Type Management REST API does not correctly isola…3.8
• CVE-2025-1478An issue has been discovered in GitLab CE/EE affecting all v…7.5
• CVE-2025-14782The Forminator Forms – Contact Form, Payment Form & Custom F…5.3
• CVE-2025-14783The Easy Digital Downloads plugin for WordPress is vulnerabl…4.3
• CVE-2025-14785The Website Builder by SeedProd - Theme Builder, Landing Pag…6.4
• CVE-2025-1479An open debug interface was reported in the Legion Space sof…5.3
• CVE-2025-14790IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …6.5
• CVE-2025-14792The Key Figures plugin for WordPress is vulnerable to Stored…4.4