CVE-2025-29015

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Code Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name parameter in /admin/pages_account.php.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 17, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-290178.8A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in theCVE-2025-290184.8A Stored Cross-Site Scripting (XSS) vulnerability exists in the name parameter of pages_add_acc_type.php in Code Astro Internet Banking SystCVE-2025-29028.3Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual StorageCVE-2025-290299.8Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formSetSpeedWan function.CVE-2025-29038.5An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can logCVE-2025-290309.8Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the formWifiWpsOOB function.CVE-2025-290319.8Tenda AC6 v15.03.05.16 was discovered to contain a buffer overflow via the fromAddressNat function.CVE-2025-290325.9Tenda AC9 v15.03.05.19(6318) was discovered to contain a buffer overflow via the formWifiWpsOOB function.CVE-2025-290337.3An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parCVE-2025-290365.9An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component.CVE-2025-290397.2An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x41dda8CVE-2025-290409.8An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41737c