CVE-2025-11905

yanyutao0402 ChanCMS gather.js getArticle code injection

A vulnerability was found in yanyutao0402 ChanCMS up to 3.3.2. This vulnerability affects the function getArticle of the file app\modules\cms\controller\gather.js. The manipulation results in code injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Chancms Yanyutao0402

Products

Chancms Chancms

CVE-2025-11512

code-projects Voting System voters_add.php cross site scripting

A vulnerability was found in code-projects Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/voters_add.php. The manipulation of the argument Firstname/Lastname/Platform results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects Fabian

Products

Voting System Voting System

CVE-2025-11425

projectworlds Advanced Library Management System edit_admin.php cross site scripting

A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /edit_admin.php. The manipulation of the argument firstname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Other parameters might be affected as well.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Projectworlds

Products

Advanced Library Management System

CVE-2025-11421

code-projects Voting System candidates_edit.php cross site scripting

A flaw has been found in code-projects Voting System 1.0. The affected element is an unknown function of the file /admin/candidates_edit.php. This manipulation of the argument Firstname/Lastname/Platform causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects Fabian

Products

Voting System Voting System

CVE-2025-11344

ILIAS Certificate Import code injection

A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality of the component Certificate Import Handler. The manipulation results in Remote Code Execution. The attack may be performed from remote. Upgrading to version 8.24, 9.14 and 10.2 addresses this issue. It is recommended to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ilias

Products

Ilias

CVE-2025-11306

qianfox FoxCMS Search cross site scripting

A vulnerability was found in qianfox FoxCMS up to 1.2. This affects an unknown part of the file /index.php/Search of the component Search Page. The manipulation of the argument keyword results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qianfox

Products

Foxcms

CVE-2025-13484

Campcodes Complete Online Beauty Parlor Management System customer-list.php cross site scripting

A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/customer-list.php. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Complete Online Beauty Parlor Management System Online Beauty Parlor Management System

CVE-2025-13182

pojoin h3blog addtitle cross site scripting

A vulnerability was identified in pojoin h3blog 1.0. The impacted element is an unknown function of the file /admin/cms/category/addtitle. The manipulation of the argument Title leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

H3blog Pojoin

Products

H3blog H3blog

CVE-2025-12920

qianfox FoxCMS Product.php edit cross site scripting

A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admin/controller/Product.php. This manipulation of the argument Title causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Foxcms Qianfox

Products

Foxcms Foxcms

CVE-2025-14991

Campcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scripting

A weakness has been identified in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/bwdates-reports-details.php. Executing a manipulation of the argument fromdate can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Complete Online Beauty Parlor Management System

CVE-2025-14962

code-projects Simple Stock System chatuser.php cross site scripting

A flaw has been found in code-projects Simple Stock System 1.0. The impacted element is an unknown function of the file /market/chatuser.php. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Carmelo Code-projects

Products

Simple Stock System Simple Stock System

CVE-2025-14856

y_project RuoYi getnames code injection

A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Such manipulation of the argument fragment leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ruoyi Y Project

Products

Ruoyi Ruoyi

CVE-2025-14005

dayrui XunRuiCMS Add Display Name Field admind45f74adbd95.php cross site scripting

A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. Affected by this vulnerability is an unknown functionality of the file /admind45f74adbd95.php?c=field&m=add&rname=site&rid=1&page=0 of the component Add Display Name Field. Executing a manipulation of the argument data[name] can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Xunruicms

Products

Xunruicms

CVE-2025-15214

Campcodes Park Ticketing System admin_class.php save_pricing cross site scripting

A vulnerability was found in Campcodes Park Ticketing System 1.0. The impacted element is the function save_pricing of the file admin_class.php. The manipulation of the argument name/ride results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Park Ticketing System

CVE-2025-14837

ZZCMS Backend Website Settings siteconfig.php stripfxg code injection

A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Website Settings Module. Such manipulation of the argument icp leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Zzcms

Products

Zzcms

CVE-2025-14580

Qualitor viewDocumento.php cross site scripting

A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php. Such manipulation of the argument cdscript leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. It is suggested to upgrade the affected component. The vendor confirms the existence of the issue: "We became aware of the issue through an earlier direct notification from the original reporter, and our engineering team promptly investigated and implemented the necessary corrective measures. (...) Updated versions containing the fix have already been provided to our customer base".

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Qualitor

Products

Qualitor

CVE-2025-14244

GreenCMS Menu Management CustomController.class.php cross site scripting

A flaw has been found in GreenCMS 2.3.0603. Affected by this issue is some unknown functionality of the file /Admin/Controller/CustomController.class.php of the component Menu Management Page. This manipulation of the argument Link causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Greencms Njtech

Products

Greencms Greencms

CVE-2025-14201

alokjaiswal Hotel-Management-services-using-MYSQL-and-php dishsub.php cross site scripting

A vulnerability was found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Affected by this vulnerability is an unknown functionality of the file /dishsub.php. The manipulation of the argument item.name results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Alokjaiswal

Products

Hotel-management-services-using-mysql-and-php

CVE-2025-14200

alokjaiswal Hotel-Management-services-using-MYSQL-and-php Request Pending usersub.php cross site scripting

A vulnerability has been found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Affected is an unknown function of the file /usersub.php of the component Request Pending Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Alokjaiswal

Products

Hotel-management-services-using-mysql-and-php

CVE-2025-14194

code-projects Employee Profile Management System view_personnel.php cross site scripting

A vulnerability was identified in code-projects Employee Profile Management System 1.0. This issue affects some unknown processing of the file /view_personnel.php. The manipulation of the argument per_address/dr_school/other_school leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Carmelogarcia Code-projects

Products

Employee Profile Management System Employee Profile Management System