CVE-2025-12281
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A cross site scripting vulnerability was determined in code-projects Client Details System 1.0. An unknown function of the file /admin/clientview.php is impacted. The attack can be launched remotely and the exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely inject a malicious script executed in the administrator's browser, potentially leading to session or data theft. The public availability of the exploit increases the risk of exploitation.
Recommendation
Update Client Details System to a fixed version or implement input validation and sanitization in the file /admin/clientview.php. Until a fix is available, restrict access to the administrative panel.
Other vulnerabilities in code-projects Client Details System
See all- CVE-2025-12283Medium
A security flaw has been discovered in code-projects Client Details System 1.0, involving an authorization bypass in an unknown function. The attack can be launched remotely and the exploit has been released to the public.
- CVE-2025-12282Low
A vulnerability was identified in code-projects Client Details System 1.0 in an unknown function of /admin/manage-users.php. Manipulation leads to cross site scripting. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2025-12280Low
A cross site scripting vulnerability was found in code-projects Client Details System 1.0. The issue affects some unknown processing of the file /update-clients.php. The attack can be initiated remotely and the exploit has been made public.
- CVE-2025-60302Medium
A Cross-Site Scripting (XSS) vulnerability has been found in code-projects Client Details System 1.0. Malicious JavaScript code can be injected into the username field when adding customer information.
Original NVD description (English source)
A vulnerability was determined in code-projects Client Details System 1.0. Impacted is an unknown function of the file /admin/clientview.php. Executing manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS