CVE-2025-13412CWE-79CWE-94cross-site-scriptingcode-injection

CVE-2025-13412

Low · published November 20, 2025

CVSS v3.1

2.4

EPSS

Percentile

18.2

In the wild

Unconfirmed

What it is

A vulnerability was determined in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_running.php. Executing a manipulation of the argument product_name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

The record

Technical detail

CVSS v3.1: 2.4 · LOW
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00270 · 18.2th percentile
Weaknesses: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2025-11-20T02:15Z

Affected products (1)

Product	Versions	Fixed in
campcodes/retro_basketball_shoes_online_store	all versions	—

References (6)

https://github.com/laosijivul/cve/issues/1 · [email protected]https://vuldb.com/?ctiid.332939 · [email protected]https://vuldb.com/?id.332939 · [email protected]https://vuldb.com/?submit.693698 · [email protected]https://www.campcodes.com/ · [email protected]https://github.com/laosijivul/cve/issues/1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

19 NOV 21:02Z
Campcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting
cvelistv5