PT-2025-44061 · Unknown · Code-Projects E-Commerce Website

Yyj_0815 · Published 2025-10-27 · Updated 2026-01-15 · CVE-2025-12334

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions code-projects E-Commerce Website version 1.0

Description A flaw exists in code-projects E-Commerce Website 1.0 that allows for cross site scripting. The issue is located in the /pages/product add.php file. Manipulation of the prod name, prod desc, or prod cost arguments can trigger the flaw. The attack can be launched remotely, and the exploit is publicly available.

Recommendations Apply a fix to the vulnerable file /pages/product add.php to sanitize the prod name, prod desc, and prod cost arguments.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-12334

Affected Products

Code-Projects E-Commerce Website

References · 10

• 🔥 https://figshare.com/s/026d2a9dffbc7385777b · Exploit
• https://osv.dev/vulnerability/CVE-2025-12334 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12334 · Security Note
• https://vuldb.com/?id.330121 · Note
• https://vuldb.com/?submit.674484 · Note
• https://t.me/cveNotify/140572 · Telegram Post
• https://twitter.com/_cvereports/status/2011794186920505699 · Twitter Post
• https://code-projects.org · Note
• https://vuldb.com/?ctiid.330121 · Note
• https://t.me/CVEtracker/35910 · Telegram Post