CVE-2025-1196

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the file /search.php. The manipulation of the argument PropertyName leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
code-projects	Real Estate Property Management System	1.0

References

https://code-projects.org/Product
https://github.com/YinshengLu/CVE/blob/main/cve2.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.295104Permissions Required, VDB Entry
https://vuldb.com/?id.295104VDB Entry
https://vuldb.com/?submit.496855VDB Entry

Timeline

Published: Feb 12, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-119606.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aryom Software High Technology CVE-2025-119611.9pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string arg CVE-2025-119627.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DivvyDrive Information Technolo CVE-2025-119635.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade L CVE-2025-119641.9On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents usin CVE-2025-119657.5In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to CVE-2025-119666.4In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted in CVE-2025-119677.2The Mail Mint plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_contact_attrib CVE-2025-119699.4The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative CVE-2025-11977.5A vulnerability has been found in code-projects Real Estate Property Management System 1.0 and classified as critical. Affected by this vuln CVE-2025-119704.4The Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated plugin for WordPress is CVE-2025-119716.5GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that