CVE-2025-65215

MediumCVSS 6.1/10Last modified Nov 4, 2026

Description

Sourcecodester Web-based Pharmacy Product Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /product_expiry/add-supplier.php via the Supplier Name field.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/vabnamoni/CVE-Researches/blob/main/CVE-2025-65215Exploit, Third Party Advisory
https://www.linkedin.com/in/vabna-lina-24ab17186/Not Applicable

Timeline

Published: Dec 2, 2025
Last modified: Nov 4, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-65225.4Unauthenticated users on an adjacent network with the Sight Bulb Pro can run shell commands as root through a vulnerable proprietary TCP p CVE-2025-652204.3Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow in: /goform/SetVirtualServerCfg via the list parameter.CVE-2025-652214.3Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the list parameter of /goform/setPptpUserList.CVE-2025-652224.3Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the rebootTime parameter of /goform/SetSysAutoRebbotCfg.CVE-2025-652234.3Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the urls parameter of /goform/saveParentControlInfo.CVE-2025-652264.3Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the deviceId parameter in /goform/saveParentControlInfo.CVE-2025-652283.5A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller (f CVE-2025-652294.6A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server <= 9.0.3. An authenticated user with ac CVE-2025-65237.7Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authenticat CVE-2025-652305.4Barix Instreamer v04.06 and v04.05 contains a stored cross-site scripting (XSS) vulnerability in the Web UI Configuration Streaming Destinat CVE-2025-652316.1Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting (XSS) in the Web UI I/O & Serial configuration page, specifically CVE-2025-652336.1Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysco