PT-2025-23084 · Unknown · Real Easy Store

Edgar Carrillo · Published 2025-05-28 · Updated 2025-05-28 · CVE-2025-40651

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Real Easy Store (affected versions not specified)

Description A Reflected Cross-Site Scripting (XSS) issue allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL using the keyword parameter in "/index.php?a=search". This can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-40651

Affected Products

Real Easy Store

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-40651 · Security Note
• https://twitter.com/VulmonFeeds/status/1927742397783359571 · Twitter Post
• https://twitter.com/CVEnew/status/1927722884547465248 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-real-easy-store · Note
• https://twitter.com/incibe_cert/status/1927717191077474342 · Twitter Post