Platform
php
Fixed in
1.0.1
CVE-2025-1905 is a problematic cross-site scripting (XSS) vulnerability identified in SourceCodester Employee Management System versions 1.0 through 1.0. This flaw allows attackers to inject malicious scripts through the manipulation of the 'Full Name' argument within the employee.php file. The vulnerability is remotely exploitable and has been publicly disclosed, posing a potential risk to user data and system integrity. A patch is available in version 1.0.1.
Successful exploitation of CVE-2025-1905 allows an attacker to inject arbitrary JavaScript code into the Employee Management System. This can lead to a variety of malicious outcomes, including session hijacking, phishing attacks, and defacement of the application's user interface. An attacker could steal sensitive user data, such as login credentials or personal information stored within the system. Furthermore, the injected script could be used to redirect users to malicious websites or to perform actions on their behalf, potentially granting the attacker unauthorized access to the system and its resources. The impact is amplified if the system handles sensitive employee data or is integrated with other critical business applications.
CVE-2025-1905 has been publicly disclosed, increasing the likelihood of exploitation. While the CVSS score is LOW, the ease of exploitation and potential impact on sensitive data warrant immediate attention. No known active campaigns targeting this vulnerability have been reported as of the publication date. Public proof-of-concept code may be available, further facilitating exploitation.
Exploit Status
EPSS
0.10% (28% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-1905 is to immediately upgrade to version 1.0.1 of the Employee Management System. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the 'Full Name' field to prevent the injection of malicious scripts. Web application firewalls (WAFs) can be configured to detect and block XSS attempts targeting the employee.php file. Regularly review and update the application's security configuration to ensure best practices are followed. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload into the 'Full Name' field and verifying that it is properly sanitized.
Actualice a una versión parcheada del software. Si no hay una versión disponible, filtre las entradas del campo 'Full Name' para evitar la ejecución de código JavaScript malicioso. Considere deshabilitar temporalmente la funcionalidad hasta que se aplique una solución.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-1905 is a cross-site scripting (XSS) vulnerability affecting versions 1.0-1.0 of the Employee Management System, allowing attackers to inject malicious scripts via the 'Full Name' parameter.
You are affected if you are using Employee Management System version 1.0 or 1.0. Upgrade to version 1.0.1 to mitigate the risk.
Upgrade to version 1.0.1. As a temporary workaround, implement input validation and sanitization on the 'Full Name' field.
While no active campaigns are confirmed, the vulnerability has been publicly disclosed, increasing the likelihood of exploitation. Monitor your systems closely.
Refer to the SourceCodester website or their official communication channels for the advisory related to CVE-2025-1905.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.