CVE-2025-40641 MEDIUM

CVE-2025-40641: Stored Cross-Site Scripting (XSS) in the Multi-purpose Inventory Management System

Vendor Multi-Purpose Inventory Management System
Product Multi-Purpose Inventory Management System
Weakness CWE-79 · XSS
Published September 8, 2025
Last update September 8, 2025
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Cross-site Scripting (XSS) vulnerability stored in Multi-Purpose Inventory Management System, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request using the product_name parameter in /Controller_Products/update. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

Key dates

02Disclosure timeline

September 8, 2025 CVE published
September 8, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-36688 WordPress Simple Site Verify Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS) CVE-2025-22361 WordPress Opentracker Analytics Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-37063 CVE-2025-6126 PHPGurukul Rail Pass Management System contact.php cross site scripting CVE-2024-5583 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings