CVE-2025-51965
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
An XSS vulnerability in OURPHP up to version 8.6.1 allows an attacker to inject malicious script via the "Name" field in the "Complete Profile" functionality on the "My User Center" page. The attack requires prior registration through the front-end interface.
Risk Assessment
The risk involves the execution of arbitrary JavaScript code in the victim's browser, potentially leading to session theft, account takeover, or sensitive data leakage.
Recommendation
Immediately update OURPHP to the latest version that fixes this vulnerability. If an update is not possible, apply input filtering and validation on the "Name" field.
Original NVD description (English source)
OURPHP thru 8.6.1 is vulnerable to Cross-Site Scripting (XSS) via the "Name" field of the "Complete Profile" functionality under the "My User Center" page, which can be accessed after registering through the front-end interface.