CVE-2025-7840

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability was found in Campcodes Online Movie Theater Seat Reservation System 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php?page=reserve of the component Reserve Your Seat Page. The manipulation of the argument Firstname/Lastname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
Campcodes	Online Movie Theater Seat Reservation System	1.0

References

https://github.com/N1n3b9S/cve/issues/9Exploit, Third Party Advisory
https://vuldb.com/?ctiid.316941Permissions Required
https://vuldb.com/?id.316941Third Party Advisory, VDB Entry
https://vuldb.com/?submit.617678Third Party Advisory, VDB Entry
https://www.campcodes.com/Product

Timeline

Published: Jul 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-78414.3The Sertifier Certificate & Badge Maker for WordPress – Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all ve CVE-2025-78424.3The Silencesoft RSS Reader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.6. This CVE-2025-78436.4The Auto Save Remote Images (Drafts) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including,CVE-2025-78441.0Exporting a TPM based RSA key larger than 2048 bits from the TPM could overrun a stack buffer if the default `MAX_RSA_KEY_BITS=2048` is used CVE-2025-78456.4The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and CVE-2025-78468.8The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in th CVE-2025-78478.8The AI Engine plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_simpleFileUpload(CVE-2025-78487.8A memory corruption vulnerability due to improper input validation in lvpict.cpp exists in NI LabVIEW that may result in arbitrary code exec CVE-2025-78497.8A memory corruption vulnerability due to improper error handling when a VILinkObj is null exists in NI LabVIEW that may result in arbitrary CVE-2025-78507.2A command injection vulnerability may be exploited after the admin's authentication on the web portal on Omada gateways.CVE-2025-78519.8An attacker may obtain the root shell on the underlying OS system with the restricted conditions on Omada gateways.CVE-2025-78529.8The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() f