PT-2025-21178 · Sourcecodester · Sourcecodester Best Employee Management System

Published 2025-05-14 · Updated 2025-05-14 · CVE-2025-44184

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Employee Management System version V1.0

Description: The issue concerns a Cross Site Scripting (XSS) vulnerability. It affects the /admin/profile.php endpoint via the website image, fname, lname, contact, username, and address parameters.

Recommendations: For SourceCodester Best Employee Management System version V1.0, consider restricting access to the /admin/profile.php endpoint until a fix is available. As a temporary workaround, avoid using the website image, fname, lname, contact, username, and address parameters in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-44184

Affected Products

Sourcecodester Best Employee Management System

References · 5

• 🔥 https://github.com/cumakurt/CVE-SourceCodester-Best-Employee-Management-System-1.0/blob/main/CVE-2025-44184-SourceCodester-Best-Employee-Management-System-1.0-Stored%20XSS.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-44184 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-44184 · Security Note
• https://twitter.com/CVEnew/status/1922695657938440513 · Twitter Post
• https://sourcecodester.com/php/17689/best-employee-management-system-php.html · Note