CVE-2025-12335CWE-79CWE-94cross-site-scriptingcode-injection

CVE-2025-12335

Medium · published October 28, 2025

CVSS v3.1

4.3

EPSS

Percentile

32.5

In the wild

Unconfirmed

What it is

A vulnerability was determined in code-projects E-Commerce Website 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/supplier_update.php. This manipulation of the argument supp_name/supp_address causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00395 · 32.5th percentile
Weaknesses: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2025-10-28T04:15Z

Affected products (1)

Product	Versions	Fixed in
fabian/e-commerce_website	all versions	—

References (5)

https://code-projects.org/ · [email protected]https://figshare.com/s/3e547f5ef85470696c2a · [email protected]https://vuldb.com/?ctiid.330122 · [email protected]https://vuldb.com/?id.330122 · [email protected]https://vuldb.com/?submit.674485 · [email protected]

EPSS history

Timeline

27 OCT 23:32Z
code-projects E-Commerce Website supplier_update.php cross site scripting
cvelistv5