CVE-2025-60302
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability has been found in code-projects Client Details System 1.0. Malicious JavaScript code can be injected into the username field when adding customer information.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other unauthorized actions within the victim's browser context.
Recommendation
Immediately update the system to the latest version or implement input filtering and validation for the username field.
Other vulnerabilities in code-projects Client Details System
See all- CVE-2025-12283Medium
A security flaw has been discovered in code-projects Client Details System 1.0, involving an authorization bypass in an unknown function. The attack can be launched remotely and the exploit has been released to the public.
- CVE-2025-12282Low
A vulnerability was identified in code-projects Client Details System 1.0 in an unknown function of /admin/manage-users.php. Manipulation leads to cross site scripting. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2025-12281Low
A cross site scripting vulnerability was determined in code-projects Client Details System 1.0. An unknown function of the file /admin/clientview.php is impacted. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2025-12280Low
A cross site scripting vulnerability was found in code-projects Client Details System 1.0. The issue affects some unknown processing of the file /update-clients.php. The attack can be initiated remotely and the exploit has been made public.
Original NVD description (English source)
code-projects Client Details System 1.0 is vulnerable to Cross Site Scripting (XSS). When adding customer information, the client details system fills in malicious JavaScript code in the username field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS