PT-2025-44061 · Unknown · Code-Projects E-Commerce Website

Yyj_0815 · Publicado 2025-10-27 · Atualizado 2026-01-15 · CVE-2025-12334

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions code-projects E-Commerce Website version 1.0

Description A flaw exists in code-projects E-Commerce Website 1.0 that allows for cross site scripting. The issue is located in the /pages/product add.php file. Manipulation of the prod name, prod desc, or prod cost arguments can trigger the flaw. The attack can be launched remotely, and the exploit is publicly available.

Recommendations Apply a fix to the vulnerable file /pages/product add.php to sanitize the prod name, prod desc, and prod cost arguments.

Exploit

Correção

XSS

Code Injection

Enumeração de Fraquezas

CWE-79

CWE-94

Identificadores relacionados

CVE-2025-12334

Produtos afetados

Code-Projects E-Commerce Website

Referências · 10

• 🔥 https://figshare.com/s/026d2a9dffbc7385777b · Exploit
• https://vuldb.com/?id.330121 · Nota
• https://vuldb.com/?submit.674484 · Nota
• https://t.me/cveNotify/140572 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-12334 · Aviso do Fabricante
• https://twitter.com/_cvereports/status/2011794186920505699 · Publicação no Twitter
• https://code-projects.org · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-12334 · Nota de Segurança
• https://vuldb.com/?ctiid.330121 · Nota
• https://t.me/CVEtracker/35910 · Publicação no Telegram