1.0.1
A problematic cross-site scripting (XSS) vulnerability has been identified in Wazifa System versions 1.0 through 1.0. The vulnerability resides within the searchuser function of the /search_resualts.php file. Attackers can exploit this by manipulating the firstname or lastname arguments, potentially leading to malicious script execution. A fix is available in version 1.0.1.
Successful exploitation of CVE-2025-1209 allows an attacker to inject arbitrary JavaScript code into the Wazifa System application. This can lead to various malicious outcomes, including session hijacking, defacement of the application, and redirection of users to phishing sites. The attacker could potentially steal sensitive user data, such as login credentials or personal information, depending on the application's functionality and data handling practices. Because the vulnerability is triggered via user input, it is relatively easy to exploit, especially if the application lacks proper input sanitization.
This vulnerability has been publicly disclosed, increasing the risk of exploitation. While the CVSS score is LOW, the ease of exploitation means it could be targeted by opportunistic attackers. No known active campaigns or KEV listing at the time of writing. Public proof-of-concept code is likely to emerge given the disclosure.
Exploit Status
EPSS
0.27% (50% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-1209 is to upgrade Wazifa System to version 1.0.1 or later, which contains the necessary fix. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the firstname and lastname parameters within the /search_resualts.php file. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Review and strengthen the application's overall input sanitization practices to prevent similar vulnerabilities in the future. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload via the search functionality.
Update to a patched version or apply the necessary fixes in the `/search_resualts.php` file to prevent XSS code execution. Escape or sanitize the inputs of the `firstname` and `lastname` parameters before displaying them on the web page. Validate and filter input data to prevent malicious code injection.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-1209 is a cross-site scripting (XSS) vulnerability in Wazifa System 1.0, allowing attackers to inject malicious scripts via the firstname/lastname parameters in /search_resualts.php.
Yes, if you are running Wazifa System version 1.0, you are affected by this vulnerability. Upgrade to version 1.0.1 or later to mitigate the risk.
Upgrade Wazifa System to version 1.0.1 or later. As a temporary workaround, implement input validation and output encoding on the firstname and lastname parameters.
While no active campaigns are currently confirmed, the vulnerability has been publicly disclosed, increasing the likelihood of exploitation.
Refer to the Wazifa System project's official website or repository for the latest security advisories and updates related to CVE-2025-1209.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.