Stored Cross-Site Scripting Vulnerability in Multi-Purpose Inventory Management System by Vendor XYZ

CVE-2025-40641

What is CVE-2025-40641?

The Multi-Purpose Inventory Management System is susceptible to a stored Cross-Site Scripting (XSS) vulnerability. This issue arises due to inadequate validation of user input when processing POST requests with the product_name parameter in /Controller_Products/update. A malicious actor could exploit this flaw by crafting a specific query, enabling them to hijack an authenticated user's session and access sensitive cookie details, thereby posing a significant security risk.

References