Stored Cross-Site Scripting Vulnerability in Configuroweb Inventory System
CVE-2025-60314

5.4MEDIUM

Key Information:

Vendor

Configuroweb

Status
Sistema Web de Inventario
Vendor
CVE Published:
8 October 2025

What is CVE-2025-60314?

The Configuroweb Sistema Web de Inventario 1.0 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This issue arises from improper input sanitization specifically in the product name parameter, allowing an authenticated attacker to inject malicious JavaScript payloads. If exploited, such vulnerabilities can lead to serious security risks, including session hijacking and unauthorized actions on behalf of the user. Protecting against this requires proper validation and sanitization of user inputs to prevent the injection of harmful code.

References

https://github.com/configuroweb/inventariobasico
https://configuroweb.com/sistema-web-de-inventario-simple...
https://github.com/ChuckBartowski7/Vulnerability-Research...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.