CVE-2025-12229CWE-79CWE-94cross-site-scriptingcode-injection

CVE-2025-12229

Low · published October 27, 2025

CVSS v3.1

2.4

EPSS

Percentile

16.6

In the wild

Unconfirmed

What it is

A security flaw has been discovered in projectworlds Expense Management System 1.0. This affects an unknown function of the file /public/admin/roles/create of the component Roles Page. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

The record

Technical detail

CVSS v3.1: 2.4 · LOW
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00259 · 16.6th percentile
Weaknesses: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2025-10-27T10:15Z

Affected products (1)

Product	Versions	Fixed in
projectworlds/expense_management_system	all versions	—

References (4)

https://github.com/QIU-DIE/CVE/issues/10 · [email protected]https://vuldb.com/?ctiid.329899 · [email protected]https://vuldb.com/?id.329899 · [email protected]https://vuldb.com/?submit.673706 · [email protected]

EPSS history

Timeline

27 OCT 05:32Z
projectworlds Expense Management System Roles Page create cross site scripting
cvelistv5