Vulnerability · Published Nov 19, 2025 · Assigned by VulDB

CVE-2025-13412Campcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting

Low 2.4

In plain English

A low-severity cross-site scripting in Retro Basketball Shoes Online Store from Campcodes. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low

Exploit odds (30 days)0.3%top 80.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_running.php. Executing a manipulation of the argument product_name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Affected products (as reported)

Vendor	Product	Versions
Campcodes	Retro Basketball Shoes Online Store	1.0

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-332939 | Campcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting vdb-entry, technical-description
VDB-332939 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #693698 | campcodes Retro Basketball Shoes Online Store V1.0 cross site scripting third-party-advisory
https://github.com/laosijivul/cve/issues/1 exploit, issue-tracking
https://www.campcodes.com/ product