CVE-2025-61456

🛡️ CVE 공개: CVE-2025-61456 — 전자상거래 프로젝트의 반사형 XSS 공개 날짜: 2025년 10월 14일 CVE ID: CVE-2025-61456 심각도: 중간 CVSS 6.1 🧩 요약 E-commerce Project v1.0의 index.php 엔드포인트에서 반사형 교차 사이트 스크립팅XSS 취약점이 발견되었습니다. URL 경로 매개변수의 무결화되지 않은 입력이 응답 HTML에 직접 반영되어, 공격자가 악성 링크를 방문하거나 조작된 요청을 제출한 사용자의 브라우저에서 임의의 JavaScript를 실행할 수...

CVE-2025-61456

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

EUVD-2025-35051

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

EUVD-2025-35046

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61456

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61454

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61455

A CRITICAL SQL Injection vulnerability exists in Bhabishya-123 E-commerce v1.0 within the signup.inc.php endpoint (and potentially the https://t.co/ox4NNwmsS5.php endpoint). The root cause is the application's direct incorporation of unsanitized user inputs, specifically the email parameter, into...

CVE-2025-61456

A Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce v1.0 within the index.php endpoint. The root cause is the failure to sanitize the URL path parameter before reflecting it into the HTML response, specifically via the /index parameter. Attackers can inject JavaScript pa...

CVE-2025-61454

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61454

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61456

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61456: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61455: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the signup.inc.php endpoint. The application directly incorporates unsanitized user inputs into SQL queries, allowing unauthenticated attackers to bypass authentication and gain full access...

PT-2025-42758

Name of the Vulnerable Software and Affected Versions Bhabishya-123 E-commerce version 1.0 Description A Cross-Site Scripting XSS issue exists in the software, specifically within the search functionality. The /search API endpoint reflects unsanitized input directly into the response HTML,...

PT-2025-42760

Name of the Vulnerable Software and Affected Versions Bhabishya-123 E-commerce version 1.0 Description A SQL Injection issue exists in Bhabishya-123 E-commerce. The application incorporates unsanitized user inputs directly into SQL queries. This allows unauthenticated attackers to bypass...

PT-2025-42766

Name of the Vulnerable Software and Affected Versions Bhabishya-123 E-commerce version 1.0 Description A Cross-Site Scripting XSS issue exists in the software, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML,...

CVE-2025-61454: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the search endpoint. Unsanitized input in the /search parameter is directly reflected back into the response HTML, allowing attackers to execute arbitrary JavaScript in the browser of a user who...

CVE-2025-61454

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Bhabishya-123 E-commerce v1.0 within the search.php endpoint. The root cause is the failure to sanitize the search parameter from POST data before reflecting it back into the response HTML. An attacker can craft a request containing m...