CVE-2025-13343

LowCVSS 3.5

Published: 18/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

34th percentile - higher than 34% of all known CVEs

Summary

A security flaw has been discovered in SourceCodester Interview Management System 1.0. Affected is an unknown function of the file /editQuestion.php. Manipulation of the argument Question results in cross-site scripting. It is possible to launch the attack remotely. The exploit has been released publicly and may be exploited.

Risk Assessment

An attacker could inject malicious JavaScript that executes in the user's browser, potentially leading to session theft or other attacks. This could harm system users.

Recommendation

Update the system to the latest version if available, or apply input filtering and output encoding. Consider deploying a Web Application Firewall (WAF).

Other vulnerabilities in Interview Management System

CVE-2026-15137High
A SQL injection vulnerability has been found in Interview Management System 1.0 in the file \inc\classes\View.php via the ID argument. The attack can be performed remotely and the exploit is publicly available.

Original NVD description (English source)

A security flaw has been discovered in SourceCodester Interview Management System 1.0. Affected is an unknown function of the file /editQuestion.php. The manipulation of the argument Question results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS