CVE-2025-7141

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic was found in SourceCodester Best Salon Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /panel/edit_plan.php of the component Update Staff Page. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jul 7, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-714105.3Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CCVE-2025-714115.3Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload. CVE-2025-714127.1Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper respoCVE-2025-714135.3Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers cause repeated resets which may result in iCVE-2025-714176.5PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowCVE-2025-714185.3PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients to waste server resoCVE-2025-714195.4UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameteCVE-2025-71425.4A vulnerability, which was classified as problematic, has been found in SourceCodester Best Salon Management System 1.0. Affected by this isCVE-2025-714204.3UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agenCVE-2025-714217.2UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents withCVE-2025-714225.7Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable CVE-2025-714237.3Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewM
CVE-2025-7141: Medium severity, CVSS 5.4 | Vulnix