{"id":"CVE-2025-7141","state":"PUBLISHED","title":"SourceCodester Best Salon Management System Update Staff Page edit_plan.php cross site scripting","description":"A vulnerability classified as problematic was found in SourceCodester Best Salon Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /panel/edit_plan.php of the component Update Staff Page. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.","publishedAt":"2025-07-07T19:02:05.791Z","updatedAt":"2025-07-07T20:50:46.358Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Best Salon Management System"],"affected":[{"vendor":"SourceCodester","product":"Best Salon Management System","versions":[{"version":"1.0","status":"affected"}],"modules":["Update Staff Page"]}],"references":["https://vuldb.com/?id.315055","https://vuldb.com/?ctiid.315055","https://vuldb.com/?submit.605988","https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/xss-3.md","https://www.sourcecodester.com/"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:10:04.440Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/7xxx/CVE-2025-7141.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-7141","state":"PUBLISHED","datePublished":"2025-07-07T19:02:05.791Z","dateUpdated":"2025-07-07T20:50:46.358Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-07-06T19:04:29.837Z"},"containers":{"cna":{"title":"SourceCodester Best Salon Management System Update Staff Page edit_plan.php cross site scripting","descriptions":[{"lang":"en","value":"A vulnerability classified as problematic was found in SourceCodester Best Salon Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /panel/edit_plan.php of the component Update Staff Page. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"In SourceCodester Best Salon Management System 1.0 wurde eine problematische Schwachstelle entdeckt. Es geht um eine nicht näher bekannte Funktion der Datei /panel/edit_plan.php der Komponente Update Staff Page. Durch Manipulation mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"SourceCodester","product":"Best Salon Management System","versions":[{"version":"1.0","status":"affected"}],"modules":["Update Staff Page"]}],"references":[{"url":"https://vuldb.com/?id.315055","name":"VDB-315055 | SourceCodester Best Salon Management System Update Staff Page edit_plan.php cross site scripting","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.315055","name":"VDB-315055 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.605988","name":"Submit #605988 | www.sourcecodester.com Best salon management system 1.0 Doubled Character XSS Manipulations","tags":["third-party-advisory"]},{"url":"https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/xss-3.md","tags":["exploit"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":3.3,"vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-07-07T19:02:05.791Z"},"timeline":[{"time":"2025-07-06T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-07-06T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-07-06T21:09:50.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Colorado-all (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-07T20:50:30.098701Z","id":"CVE-2025-7141","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-07T20:50:46.358Z"}}]}}}