CVE-2025-51971

Katalog CVE

CVSS 5.4 · Medium EPSS 0,27%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada puneethreddyhc online shopping system advanced. Skor CVSS 3.1 5.4 (Medium) menurut CISA ADP.

Deskripsi (NVD)

A reflected Cross-Site Scripting (XSS) vulnerability exists in register.php of PuneethReddyHC Online Shopping System Advanced 1.0. Unsanitized user input in the f_name parameter is reflected in the server response without proper HTML encoding or output escaping. This allows remote attackers to inject arbitrary JavaScript code.

Rincian

Terbit di NVD

28 Agustus 2025

Terakhir diubah

26 September 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jairajparyani/CVE-s/blob/main/CVE-2025-51971%20%E2%80%93%20Reflected%20Cross-Site%20Scripti... exploit · advisory pihak ketiga