CVE-2025-12334

32th percentile - higher than 32% of all known CVEs

A vulnerability was found in code-projects E-Commerce Website 1.0 affecting an unknown function of the file /pages/product_add.php. Manipulation of the prod_name/prod_desc/prod_cost arguments results in cross site scripting. The attack can be launched remotely and the exploit has been made public.

An attacker can remotely inject malicious script that executes in the victim's browser, potentially leading to session theft, redirections, or defacement. The public exploit increases the risk of exploitation.

Update the application to a version that fixes the vulnerability or apply input validation and sanitization for the prod_name, prod_desc, and prod_cost arguments. Implement CSP headers and monitor for unusual requests.