CVE-2025-12334CWE-79CWE-94cross-site-scriptingcode-injection

CVE-2025-12334

Medium · published October 28, 2025

CVSS v3.1

4.3

EPSS

Percentile

32.5

In the wild

Unconfirmed

What it is

A vulnerability was found in code-projects E-Commerce Website 1.0. Affected is an unknown function of the file /pages/product_add.php. The manipulation of the argument prod_name/prod_desc/prod_cost results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00395 · 32.5th percentile
Weaknesses: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2025-10-28T03:15Z

Affected products (1)

Product	Versions	Fixed in
fabian/e-commerce_website	all versions	—

References (5)

https://code-projects.org/ · [email protected]https://figshare.com/s/026d2a9dffbc7385777b · [email protected]https://vuldb.com/?ctiid.330121 · [email protected]https://vuldb.com/?id.330121 · [email protected]https://vuldb.com/?submit.674484 · [email protected]

EPSS history

Timeline

27 OCT 22:32Z
code-projects E-Commerce Website product_add.php cross site scripting
cvelistv5