Reflected Cross-Site Scripting Vulnerability in Daily Expense Manager by INCT

CVE-2025-40733

What is CVE-2025-40733?

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Daily Expense Manager version 1.0, allowing attackers to inject and execute malicious JavaScript code. This is achieved by manipulating the username parameter in POST requests directed at /login.php. Exploiting this flaw can lead to unauthorized actions on behalf of users, potentially compromising sensitive information and user session integrity.

References