PT-2025-4070 · Unknown · Needyamin Library Card System

Maloy Roy Orko + 1 · Published 2025-01-29 · Updated 2025-02-04 · CVE-2025-0844

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions needyamin Library Card System version 1.0

Description A problem was found in the needyamin Library Card System. It affects an unknown functionality of the file signup.php of the component Registration Page. The manipulation of the arguments firstname, lastname, email, borrow, user address leads to cross site scripting. The attack can be launched remotely. Other parameters might be affected as well.

Recommendations needyamin Library Card System version 1.0: Update the signup.php file in the Registration Page component to prevent the manipulation of the firstname, lastname, email, borrow, user address arguments, which lead to cross site scripting.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-0844

Affected Products

Needyamin Library Card System

References · 11

• 🔥 https://websecurityinsights.my.id/2025/01/library-card-system-stored-cross-site.html?m=1 · Exploit
• https://osv.dev/vulnerability/CVE-2025-0844 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0844 · Security Note
• https://vuldb.com/?id.294001 · Note
• https://vuldb.com/?submit.485558 · Note
• https://vuldb.com/?ctiid.294001 · Note
• https://twitter.com/VulmonFeeds/status/1884766491720941700 · Twitter Post
• https://twitter.com/CVEnew/status/1884747490362298705 · Twitter Post
• https://t.me/cvenotify/109898 · Telegram Post
• https://t.me/cvedetector/16730 · Telegram Post
• https://t.me/cvenotify/109110 · Telegram Post