CVE-2025-63442

MediumCVSS 4.6/10Last modified Nov 5, 2026

Description

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting (XSS) via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Nov 3, 2025
Last modified
Nov 5, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-634435.4School Management System PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /login.php via the password parameter.CVE-2025-634466.1Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_vendor.php.CVE-2025-634476.1Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_customer.php.CVE-2025-634486.1Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1.CVE-2025-634495.4Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /orders.php.CVE-2025-63455.4A vulnerability was found in SourceCodester My Food Recipe 1.0 and classified as problematic. Affected by this issue is the function addReciCVE-2025-634505.4Car-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php.CVE-2025-634519.8Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php.CVE-2025-634529.4Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php.CVE-2025-634539.8Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php.CVE-2025-634547.5Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the deviceId parameter in the get_parentControl_list_Info functionCVE-2025-634557.5Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. Th
CVE-2025-63442: Medium severity, CVSS 4.6 | Vulnix