CVE-2025-15583

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file utility/function.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
detronetdip	E-commerce	1.0.0

References

https://github.com/Nixon-H/PHP-Stored-XSS-Bypass-Real-EscapeExploit, Mitigation, Third Party Advisory
https://github.com/detronetdip/E-commerce/Product
https://github.com/detronetdip/E-commerce/issues/23Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.346487Permissions Required, VDB Entry
https://vuldb.com/?id.346487Third Party Advisory, VDB Entry
https://vuldb.com/?submit.754033Third Party Advisory, VDB Entry

Timeline

Published: Feb 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-155846.8Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation o CVE-2025-155856.7Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function. Successf CVE-2025-1558610.0OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can r CVE-2025-155878.6Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password b CVE-2025-155897.2A vulnerability was determined in MuYuCMS 2.7. Affected is the function delete_dir_file of the file application/admin/controller/Template.ph CVE-2025-15596.4The CC-IMG-Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'img' shortcode in all versions up t CVE-2025-155915.3Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious c CVE-2025-155957.8Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions.CVE-2025-155976.3A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistan CVE-2025-155985.9A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend/apps/system/middlew CVE-2025-155996.1DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute CVE-2025-15605.4The WOW Entrance Effects (WEE!) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee' shortcode in all ve