CVE-2025-14780: Xiongwei Smart Catering Cloud Platform dish_trade_detail_get sql injection

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-16 · updated 2026-06-17
Weakness: CWE-74

Description

A vulnerability was detected in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761. The affected element is an unknown function of the file /dishtrade/dish_trade_detail_get. The manipulation of the argument filter results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

Affected products

Xiongwei Smart Catering Cloud Platform: 2.1.6446.28761

References

https://github.com/zhangbuneng/3/issues/1
https://vuldb.com/?ctiid.336607
https://vuldb.com/?id.336607
https://vuldb.com/?submit.674051

Get alerted when CVE-2025-14780 or the next vulnerability affects your stack