CVE-2025-12231

MediumCVSS 4.8/10Last modified Oct 8, 2026

Description

A security vulnerability has been detected in projectworlds Expense Management System 1.0. Affected is an unknown function of the file /public/admin/expense_categories/create of the component Expense Categories Page. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
projectworlds	Expense Management System	1.0

References

https://github.com/QIU-DIE/CVE/issues/12Exploit, Issue Tracking
https://vuldb.com/?ctiid.329901Permissions Required, VDB Entry
https://vuldb.com/?id.329901Third Party Advisory, VDB Entry
https://vuldb.com/?submit.673708Third Party Advisory, VDB Entry
https://github.com/QIU-DIE/CVE/issues/12Exploit, Issue Tracking

Timeline

Published: Oct 27, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-122329.8A vulnerability was detected in Tenda CH22 1.0.0.1. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/CVE-2025-122338.8A flaw has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Exe CVE-2025-122348.8A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The man CVE-2025-122358.0A vulnerability was found in Tenda CH22 1.0.0.1. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The ma CVE-2025-122368.8A vulnerability was determined in Tenda CH22 1.0.0.1. This issue affects the function fromDhcpListClient of the file /goform/DhcpListClient.CVE-2025-122379.8A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /index.p CVE-2025-122388.8A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /a CVE-2025-122399.8A weakness has been identified in TOTOLINK A3300R 17.0.0cu.557_B20221024. The impacted element is the function setDdnsCfg of the file /cgi-b CVE-2025-12248.8A vulnerability classified as critical was found in ywoa up to 2024.07.03. This vulnerability affects the function listNameBySql of the file CVE-2025-122409.8A security vulnerability has been detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This affects the function setDmzCfg of the file /cgi-b CVE-2025-122418.8A vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This impacts the function setLanguageCfg of the file /cgi-bin/cstecg CVE-2025-122428.8A vulnerability has been found in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the fil