CVE-2025-12229

MediumCVSS 4.8/10Last modified Oct 8, 2026

Description

A security flaw has been discovered in projectworlds Expense Management System 1.0. This affects an unknown function of the file /public/admin/roles/create of the component Roles Page. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Oct 27, 2025
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-12236.1An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access ClieCVE-2025-122304.8A weakness has been identified in projectworlds Expense Management System 1.0. This impacts an unknown function of the file /public/admin/cuCVE-2025-122314.8A security vulnerability has been detected in projectworlds Expense Management System 1.0. Affected is an unknown function of the file /publCVE-2025-122329.8A vulnerability was detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/CVE-2025-122338.8A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. ExeCVE-2025-122348.8A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manCVE-2025-122358.0A vulnerability was found in Tenda CH22 1.0.0.1. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The maCVE-2025-122368.8A vulnerability was determined in Tenda CH22 1.0.0.1. This issue affects the function fromDhcpListClient of the file /goform/DhcpListClient.CVE-2025-122379.8A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /index.pCVE-2025-122388.8A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /aCVE-2025-122399.8A weakness has been identified in TOTOLINK A3300R 17.0.0cu.557_B20221024. The impacted element is the function setDdnsCfg of the file /cgi-bCVE-2025-12248.8A vulnerability classified as critical was found in ywoa up to 2024.07.03. This vulnerability affects the function listNameBySql of the file