CVE-2025-12231CWE-79CWE-94cross-site-scriptingcode-injection

CVE-2025-12231

Low · published October 27, 2025

CVSS v3.1
2.4
EPSS
0%
Percentile
16.6
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in projectworlds Expense Management System 1.0. Affected is an unknown function of the file /public/admin/expense_categories/create of the component Expense Categories Page. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

The record
Technical detail
CVSS v3.1
2.4 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00259 · 16.6th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-10-27T10:15Z
Affected products (1)
ProductVersionsFixed in
projectworlds/expense_management_systemall versions—
References (5)
https://github.com/QIU-DIE/CVE/issues/12 · [email protected]https://vuldb.com/?ctiid.329901 · [email protected]https://vuldb.com/?id.329901 · [email protected]https://vuldb.com/?submit.673708 · [email protected]https://github.com/QIU-DIE/CVE/issues/12 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 OCT 06:02Z
    projectworlds Expense Management System Expense Categories create cross site scripting
    cvelistv5