CVE-2025-12279
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability in code-projects Client Details System 1.0, affecting unknown code in the file /welcome.php. Such manipulation leads to cross-site scripting (XSS). The attack may be performed remotely. The exploit has been disclosed publicly.
Risk Assessment
XSS attack may allow execution of malicious scripts in the user's browser, potentially leading to data theft or session hijacking.
Recommendation
Update the system to the latest version if available, and implement input validation and output encoding.
Other vulnerabilities in Client Details System
See all- CVE-2025-12243Medium
A vulnerability was found in code-projects Client Details System 1.0. The file clientdetails/welcome.php in the GET Parameter Handler component is affected. Manipulation of the argument ID results in SQL injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2025-11605Medium
A vulnerability in code-projects Client Details System 1.0 affects an unknown function in the file /admin/update-profile.php. Manipulation of the argument uid leads to SQL injection. The attack can be executed remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
A vulnerability has been found in code-projects Client Details System 1.0. This vulnerability affects unknown code of the file /welcome.php. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS