Reflected XSS Vulnerability in Real Easy Store by Real Easy
CVE-2025-40651

5.1MEDIUM

Key Information:

Vendor

Real Easy Store

Status
Real Easy Store
Vendor
CVE Published:
28 May 2025

What is CVE-2025-40651?

A reflected cross-site scripting (XSS) vulnerability exists in Real Easy Store that allows attackers to inject and execute malicious JavaScript code. By crafting a malicious URL containing the keyword parameter in the /index.php?a=search endpoint, an attacker can trick victims into clicking the link. This could lead to the unauthorized access of sensitive information such as session cookies or enable unauthorized actions performed in the context of the user, thereby compromising user security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Real Easy Store all versions

References

https://www.incibe.es/en/incibe-cert/notices/aviso/reflec...

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Edgar Carrillo
JSON
.