CVE-2025-65881

The Sourcecodester Zoo Management System v1.0 is vulnerable to Cross-Site Scripting (XSS) in the /zms/classes/Login.php?f=login endpoint. The root cause is twofold: the application fails to set the Content-Type header to application/json, and the $username parameter is not properly sanitized befo...