CVE-2025-9755
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability was discovered in Khanakag-17 Library Management System up to 60ed174506094dcd166e34904a54288e5d10ff24 involving cross-site scripting in the file /index.php. Manipulation of the msg argument allows remote attack execution. The exploit is publicly available and may be used.
Risk Assessment
An attacker can remotely inject a malicious script that executes in the user's browser, potentially leading to session theft or other attacks. The public exploit increases the risk.
Recommendation
Sanitize input data and use appropriate security headers, e.g., Content-Security-Policy. Restrict access to the vulnerable file.
Other vulnerabilities in Library Management System
See all- CVE-2026-56034Critical
An unauthenticated SQL Injection vulnerability exists in Library Management System versions 3.5.7 and earlier. An attacker can remotely execute arbitrary SQL queries, leading to unauthorized database access.
- CVE-2026-18666Medium
The Library Management System WordPress plugin before version 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement. This allows users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes.
- CVE-2026-12582High
The Library Management System WordPress plugin before version 3.5.8 does not sanitize or escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes.
Original NVD description (English source)
A vulnerability has been found in Khanakag-17 Library Management System up to 60ed174506094dcd166e34904a54288e5d10ff24. This affects an unknown function of the file /index.php. The manipulation of the argument msg leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS