CVE-2025-14962CWE-79CWE-94cross-site-scriptingcode-injection

CVE-2025-14962

Medium · published December 20, 2025

CVSS v3.1

4.3

EPSS

Percentile

24.6

In the wild

Unconfirmed

What it is

A flaw has been found in code-projects Simple Stock System 1.0. The impacted element is an unknown function of the file /market/chatuser.php. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used.

The record

Technical detail

CVSS v3.1: 4.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00328 · 24.6th percentile
Weaknesses: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2025-12-20T00:15Z

Affected products (1)

Product	Versions	Fixed in
carmelo/simple_stock_system	all versions	—

References (6)

https://code-projects.org/ · [email protected]https://github.com/wyxclcw/CVE/issues/1 · [email protected]https://vuldb.com/?ctiid.337598 · [email protected]https://vuldb.com/?id.337598 · [email protected]https://vuldb.com/?submit.717640 · [email protected]https://vuldb.com/?submit.724795 · [email protected]

EPSS history

Timeline

19 DEC 18:32Z
code-projects Simple Stock System chatuser.php cross site scripting
cvelistv5