CVE-2025-12228
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A cross site scripting vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/create on the Users Page. The attack can be carried out remotely and the exploit is publicly available.
Risk Assessment
An attacker can remotely execute a malicious script in the administrator's browser, potentially leading to session or data theft. The public availability of the exploit increases the likelihood of exploitation.
Recommendation
Update Expense Management System to a fixed version or implement input validation and sanitization on the Users Page. Until a fix is available, restrict access to the administrative panel.
Other vulnerabilities in projectworlds Expense Management System
See all- CVE-2025-12231Low
A cross site scripting vulnerability has been detected in projectworlds Expense Management System 1.0. An unknown function of the file /public/admin/expense_categories/create on the Expense Categories Page is affected. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2025-12230Low
A cross site scripting weakness has been identified in projectworlds Expense Management System 1.0. An unknown function of the file /public/admin/currencies/create on the Currency Page is impacted. The attack can be initiated remotely and the exploit has been made publicly available.
- CVE-2025-12229Low
A cross site scripting security flaw has been discovered in projectworlds Expense Management System 1.0. It affects an unknown function of the file /public/admin/roles/create on the Roles Page. The attack can be performed remotely and the exploit has been released to the public.
Original NVD description (English source)
A vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/create of the component Users Page. The manipulation leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS