CVE-2025-6473

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in code-projects School Fees Payment System 1.0. This affects an unknown part of the file /fees.php. The manipulation of the argument transcation_remark leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jun 22, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-647306.1Cross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is exploited, an arbitrary script may be executeCVE-2025-647337.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker coCVE-2025-647342.4Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to peCVE-2025-647357.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker coCVE-2025-647367.1An out-of-bounds read vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (5462afbCVE-2025-647385.5External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosCVE-2025-647397.5External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via nCVE-2025-64749.8A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknoCVE-2025-647407.8Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user CVE-2025-647419.8Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalatiCVE-2025-647443.5OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization withCVE-2025-647456.1Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists