CVE-2025-0537: XSS in Car Rental Management System

The XSS vulnerability in Car Rental Management System allows an attacker to inject arbitrary JavaScript code into the application. This code will then be executed in the context of the user's browser when they access the affected page. An attacker could leverage this to steal session cookies, redirect users to malicious websites, or modify the content of the page. Given that the vulnerability exists within the /admin/manage-pages.php file, successful exploitation could grant an attacker administrative access to the system, enabling them to modify data, create new users, or perform other unauthorized actions. The impact is amplified if the administrative interface handles sensitive data or controls critical system functions.

1. Reserved2025-01-17
2. Published2025-01-17
3. Modified2025-02-12
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-0537 is to upgrade Car Rental Management System to version 1.0.1 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, implement strict input validation and output encoding on the pgdetails parameter within the /admin/manage-pages.php file. Consider using a Web Application Firewall (WAF) with XSS filtering rules to block malicious requests. Regularly review and sanitize user-supplied data to prevent similar vulnerabilities from being introduced in the future.