Reflected Cross-Site Scripting in E-commerce Project by E-commerce Vendor
CVE-2025-63879

6.1MEDIUM

Key Information:

Vendor

E-commerce Vendor

Status
E-commerce Project
Vendor
CVE Published:
19 November 2025

What is CVE-2025-63879?

A reflected cross-site scripting (XSS) vulnerability exists within the /ecommerce/products.php component of E-commerce Project versions prior to 1.0. This flaw allows attackers to inject malicious JavaScript code through the id parameter, which gets executed in the context of the victim’s web browser. This enables unauthorized actions and data exposure, emphasizing the need for stringent input validation measures in web applications.

References

https://www.linkedin.com/in/rumana-khatun-208aa731b/
https://github.com/rumanaemu/CVE-Research/blob/main/CVE-2...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.