CVE-2025-12280
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A cross site scripting vulnerability was found in code-projects Client Details System 1.0. The issue affects some unknown processing of the file /update-clients.php. The attack can be initiated remotely and the exploit has been made public.
Risk Assessment
An attacker can remotely execute a malicious script in the user's browser, potentially leading to session or data theft. The public availability of the exploit increases the likelihood of attack.
Recommendation
Update Client Details System to a fixed version or implement input validation and sanitization in the file /update-clients.php. Until a fix is available, restrict access to the administrative panel.
Other vulnerabilities in code-projects Client Details System
See all- CVE-2025-12283Medium
A security flaw has been discovered in code-projects Client Details System 1.0, involving an authorization bypass in an unknown function. The attack can be launched remotely and the exploit has been released to the public.
- CVE-2025-12282Low
A vulnerability was identified in code-projects Client Details System 1.0 in an unknown function of /admin/manage-users.php. Manipulation leads to cross site scripting. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2025-12281Low
A cross site scripting vulnerability was determined in code-projects Client Details System 1.0. An unknown function of the file /admin/clientview.php is impacted. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2025-60302Medium
A Cross-Site Scripting (XSS) vulnerability has been found in code-projects Client Details System 1.0. Malicious JavaScript code can be injected into the username field when adding customer information.
Original NVD description (English source)
A vulnerability was found in code-projects Client Details System 1.0. This issue affects some unknown processing of the file /update-clients.php. Performing manipulation results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS