CVE-2025-14962
Remote Cross-Site Scripting in Simple Stock System Chat Module
Publication date: 2025-12-19
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| code-projects | simple_stock_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2025-14962 is a reflective Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Simple Stock System PHP application, specifically in the chatuser.php file. The vulnerability occurs because the application does not properly filter or escape user-supplied input taken from the URL parameter and stored in the database before outputting it back to the webpage. This allows attackers to inject malicious JavaScript code that executes in the victim's browser, potentially leading to actions like stealing cookies or hijacking sessions. Exploitation requires no authentication and can be done remotely. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts in the browsers of users visiting the affected application. This can lead to theft of user cookies, session hijacking, phishing attacks, and other malicious activities that compromise system security and data integrity. Since the attack can be performed remotely without authentication, it poses a significant risk to both users and the system. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the vulnerable file 'chatuser.php' in the /market/ directory of the Simple Stock System 1.0 installation. Additionally, Google dorking can be used with the query 'inurl:market/chatuser.php' to identify potentially vulnerable targets. Detection can also involve monitoring for suspicious HTTP POST requests containing malicious payloads in the 'chat_msg' parameter or URL parameters like 'user' that may include script tags or JavaScript code. Specific commands are not provided, but using web vulnerability scanners or manual inspection of HTTP requests for reflected XSS payloads targeting 'chatuser.php' is recommended. [3, 1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include escaping all output by converting special characters such as <, >, ', ", and / to their corresponding HTML entities to prevent script execution. Additionally, force browsers not to parse unexpected content types by setting appropriate PHP headers, and enable XSS filtering modes in the application or web server. Since no known countermeasures or mitigations currently exist, replacing or updating the affected software is suggested. Immediate corrective actions are advised to protect system security and data integrity. [1, 3]