CVE-2025-12231
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A cross site scripting vulnerability has been detected in projectworlds Expense Management System 1.0. An unknown function of the file /public/admin/expense_categories/create on the Expense Categories Page is affected. The attack can be launched remotely and the exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely inject a malicious script that executes in the administrator's browser, potentially leading to session or data theft. Since the exploit is publicly available, the risk of exploitation is high.
Recommendation
Immediately update Expense Management System to a version without the vulnerability or apply input validation and sanitization on the Expense Categories Page. Until a fix is available, restrict access to the administrative panel.
Other vulnerabilities in projectworlds Expense Management System
See all- CVE-2025-12230Low
A cross site scripting weakness has been identified in projectworlds Expense Management System 1.0. An unknown function of the file /public/admin/currencies/create on the Currency Page is impacted. The attack can be initiated remotely and the exploit has been made publicly available.
- CVE-2025-12229Low
A cross site scripting security flaw has been discovered in projectworlds Expense Management System 1.0. It affects an unknown function of the file /public/admin/roles/create on the Roles Page. The attack can be performed remotely and the exploit has been released to the public.
- CVE-2025-12228Low
A cross site scripting vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/create on the Users Page. The attack can be carried out remotely and the exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in projectworlds Expense Management System 1.0. Affected is an unknown function of the file /public/admin/expense_categories/create of the component Expense Categories Page. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS