CVE-2025-61456

🛡️ CVE Disclosure: CVE-2025-61456 — Reflected XSS in E-commerce Project Disclosure Date: 14 October 2025 CVE ID: CVE-2025-61456 Severity: MEDIUM CVSS 6.1 🧩 Summary A reflected Cross-Site Scripting XSS vulnerability exists in the E-commerce Project v1.0, specifically within the index.php endpoint...

CVE-2025-61456

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

EUVD-2025-35051

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

EUVD-2025-35046

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61456

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61454

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61455

A CRITICAL SQL Injection vulnerability exists in Bhabishya-123 E-commerce v1.0 within the signup.inc.php endpoint (and potentially the https://t.co/ox4NNwmsS5.php endpoint). The root cause is the application's direct incorporation of unsanitized user inputs, specifically the email parameter, into...

CVE-2025-61456

A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce v1.0 within the index.php endpoint. The root cause is the failure to sanitize the URL path parameter before reflecting it into the HTML response, specifically via the /index parameter. Attackers can inject JavaScript pa...

CVE-2025-61454

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61454

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61456

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61456: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61455: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the signup.inc.php endpoint. The application directly incorporates unsanitized user inputs into SQL queries, allowing unauthenticated attackers to bypass authentication and gain full access...

PT-2025-42758

Name of the Vulnerable Software and Affected Versions Bhabishya-123 E-commerce version 1.0 Description A Cross-Site Scripting XSS issue exists in the software, specifically within the search functionality. The /search API endpoint reflects unsanitized input directly into the response HTML,...

PT-2025-42760

Name of the Vulnerable Software and Affected Versions Bhabishya-123 E-commerce version 1.0 Description A SQL Injection issue exists in Bhabishya-123 E-commerce. The application incorporates unsanitized user inputs directly into SQL queries. This allows unauthenticated attackers to bypass...

PT-2025-42766

Name of the Vulnerable Software and Affected Versions Bhabishya-123 E-commerce version 1.0 Description A Cross-Site Scripting XSS issue exists in the software, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML,...

CVE-2025-61454: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61454

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce v1.0 within the search.php endpoint. The root cause is the failure to sanitize the search parameter from POST data before reflecting it back into the response HTML. An attacker can craft a request containing m...