CVE-2025-51971CWE-89sql-injection

CVE-2025-51971

Medium · published August 28, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
18.0
In the wild
Unconfirmed
What it is

A reflected Cross-Site Scripting (XSS) vulnerability exists in register.php of PuneethReddyHC Online Shopping System Advanced 1.0. Unsanitized user input in the f_name parameter is reflected in the server response without proper HTML encoding or output escaping. This allows remote attackers to inject arbitrary JavaScript code.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00268 · 18.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-08-28T18:15Z
Affected products (1)
ProductVersionsFixed in
puneethreddyhc/online_shopping_system_advancedall versions—
References (1)
https://github.com/jairajparyani/CVE-s/blob/main/CVE-2025-51971%20%E2%80%93%20Reflected%20Cross-Site%20Scripting%20%28XSS%29%20in%20Online%20Shopping%20System · [email protected]
EPSS history
Timeline
  • 28 AUG 00:00Z
    A reflected Cross-Site Scripting (XSS) vulnerability exists in register.php of PuneethReddyHC Online Shopping System Advanced 1.0
    cvelistv5