Vulnerability · Published Dec 21, 2025 · Assigned by VulDB
CVE-2025-14991Campcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scripting
Low 2.4
In plain English
A low-severity cross-site scripting in Complete Online Beauty Parlor Management System from Campcodes. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
A weakness has been identified in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/bwdates-reports-details.php. Executing a manipulation of the argument fromdate can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Campcodes | Complete Online Beauty Parlor Management System | 1.0 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
References
- VDB-337685 | Campcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scripting vdb-entry, technical-description
- VDB-337685 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #718458 | campcodes Complete Online Beauty Parlor Management System V1.0 cross site scripting third-party-advisory
- https://github.com/funnnxxx/my-cve/issues/1 exploit, issue-tracking
- https://www.campcodes.com/ product