CVE-2025-13484

MediumCVSS 6.1/10Last modified Oct 18, 2026

Description

A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/customer-list.php. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Nov 20, 2025
Last modified: Oct 18, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-134859.8A security flaw has been discovered in itsourcecode Online File Management System 1.0. This issue affects some unknown processing of the fil CVE-2025-134869.8The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the CVE-2025-134885.1Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from reposi CVE-2025-134895.9IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 IBM DevOps Deploy transmits data in clear text that could allow an attacker to obtain sensit CVE-2025-13494.8IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to stored cros CVE-2025-134905.9IBM App Connect Operator versions CD 11.3.0 through 11.6.0 and 12.1.0 through 12.20.0, LTS versions 12.0.0 through 12.0.20, and IBM App Conn CVE-2025-134915.1IBM App Connect Enterprise Certified Container CD: 11.2.0 through 11.6.0, 12.1.0 through 12.19.0 and 12.0 LTS: 12.0.0 through 12.0.19 could CVE-2025-134927.0A potential security vulnerability has been identified in HP Image Assistant for versions prior to 5.3.3. The vulnerability c CVE-2025-134937.5The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4. T CVE-2025-134945.3The SSP Debug plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0. This is due CVE-2025-134954.9The FluentCart plugin for WordPress is vulnerable to SQL Injection via the 'groupKey' parameter in all versions up to, and including, 1.3.1.CVE-2025-134965.3The Moosend Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the m