Vulnerability · Published Oct 27, 2025 · Assigned by VulDB

CVE-2025-12335code-projects E-Commerce Website supplier_update.php cross site scripting

Medium 4.3

In plain English

A medium-severity cross-site scripting in E-Commerce Website from code-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 66.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in code-projects E-Commerce Website 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/supplier_update.php. This manipulation of the argument supp_name/supp_address causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Affected products (as reported)

Vendor	Product	Versions
code-projects	E-Commerce Website	1.0

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-330122 | code-projects E-Commerce Website supplier_update.php cross site scripting vdb-entry, technical-description
VDB-330122 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #674485 | https://code-projects.org/e-commerce-website-in-php-with-source- E-COMMERCE WEBSITE V1.0 Stored/Persistent XSS third-party-advisory
https://figshare.com/s/3e547f5ef85470696c2a exploit
https://code-projects.org/ product