CVE-2025-1169

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Image Compressor Tool 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /image-compressor/compressor.php. The manipulation of the argument image leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Feb 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-116908.5An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive inform CVE-2025-116917.5The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOM_Meta::get_fields_CVE-2025-116925.3The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on CVE-2025-116939.8The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl CVE-2025-116948.7A security issue exists within 1769 CompactLogix controllers due to the missing validation of sequence numbers and source IP addresses in th CVE-2025-116957.5When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver v CVE-2025-116968.9A local server-side request forgery (SSRF) security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability a CVE-2025-116978.9A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows us CVE-2025-116989.2A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially CVE-2025-116997.1nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attack CVE-2025-11705.4A vulnerability classified as problematic has been found in code-projects Real Estate Property Management System 1.0. Affected is an unknown CVE-2025-117007.5N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure