CVE-2025-11425

MediumCVSS 4.8/10Last modified Oct 8, 2026

Description

A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /edit_admin.php. The manipulation of the argument firstname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Other parameters might be affected as well.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
projectworlds	Advanced Library Management System	1.0

References

https://github.com/ChenGuangHuangHun/CVE/issues/2Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.327360Permissions Required, VDB Entry
https://vuldb.com/?id.327360Third Party Advisory, VDB Entry
https://vuldb.com/?submit.666213Third Party Advisory, VDB Entry
https://github.com/ChenGuangHuangHun/CVE/issues/2Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Oct 8, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-114268.8A security flaw has been discovered in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown fu CVE-2025-114275.8The WP Migrate Lite – WordPress Migration Made Easy plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions CVE-2025-114295.4A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessio CVE-2025-11438.4Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH serv CVE-2025-114309.8A vulnerability was found in SourceCodester Simple E-Commerce Bookstore 1.0. The affected element is an unknown function of the file /cart.p CVE-2025-114319.8A vulnerability was determined in code-projects Web-Based Inventory and POS System 1.0. The impacted element is an unknown function of the f CVE-2025-114329.8A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /reset.php. Such ma CVE-2025-114336.1A security flaw has been discovered in itsourcecode Leave Management System 1.0. This impacts the function redirect of the file /module/empl CVE-2025-114349.8A weakness has been identified in itsourcecode Student Transcript Processing System 1.0. Affected is an unknown function of the file /login.CVE-2025-114356.1A security vulnerability has been detected in JhumanJ OpnForm up to 1.9.3. Affected by this vulnerability is an unknown functionality of the CVE-2025-114368.8A vulnerability was detected in JhumanJ OpnForm up to 1.9.3. Affected by this issue is some unknown functionality of the file /answer. The m CVE-2025-114374.8A flaw has been found in JhumanJ OpnForm up to 1.9.3. This affects an unknown part of the file /api/open/forms/ of the component Form Editor