CVE-2025-12229
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A cross site scripting security flaw has been discovered in projectworlds Expense Management System 1.0. It affects an unknown function of the file /public/admin/roles/create on the Roles Page. The attack can be performed remotely and the exploit has been released to the public.
Risk Assessment
An attacker can remotely inject a malicious script executed in the administrator's browser, potentially leading to credential theft or session hijacking. The public availability of the exploit increases the risk of exploitation.
Recommendation
Immediately update Expense Management System to a version without the vulnerability or apply input validation and sanitization on the Roles Page. Until a fix is available, restrict access to the administrative panel.
Other vulnerabilities in projectworlds Expense Management System
See all- CVE-2025-12231Low
A cross site scripting vulnerability has been detected in projectworlds Expense Management System 1.0. An unknown function of the file /public/admin/expense_categories/create on the Expense Categories Page is affected. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2025-12230Low
A cross site scripting weakness has been identified in projectworlds Expense Management System 1.0. An unknown function of the file /public/admin/currencies/create on the Currency Page is impacted. The attack can be initiated remotely and the exploit has been made publicly available.
- CVE-2025-12228Low
A cross site scripting vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/create on the Users Page. The attack can be carried out remotely and the exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in projectworlds Expense Management System 1.0. This affects an unknown function of the file /public/admin/roles/create of the component Roles Page. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS