Langley FCU Online Banking CVE-2025-11333

Q: What is the CVSS score of CVE-2025-11333?

CVE-2025-11333 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-10-06 cna@vuldb.com

PHP XSS

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:00 vuln.today

DescriptionCVE.org

A vulnerability was identified in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a. This impacts an unknown function of the file /customer_add_action.php of the component Add Customer Page. The manipulation of the argument First Name leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.

AnalysisAI

Stored cross-site scripting (XSS) in Langley FCU Online Banking System via the First Name field on the Add Customer Page (/customer_add_action.php) allows high-privileged authenticated users to inject malicious scripts affecting other users. The CVSS score of 1.9 reflects the high privilege requirement (PR:H) and user interaction dependency (UI:P), limiting real-world risk despite public exploit availability. No active exploitation has been confirmed in CISA KEV at time of analysis.

Technical ContextAI

The vulnerability exists in PHP-based online banking software where user input from the First Name parameter is processed by /customer_add_action.php without proper output encoding or input sanitization. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that untrusted data is reflected or stored in web pages without neutralization of HTML/JavaScript special characters. The rolling-release versioning model used by the product complicates precise version tracking; the affected commit hash 57437e6400ce0ae240e692c24e6346b8d0c17d7a represents the latest known vulnerable state. Exploitation occurs through the Add Customer feature, typically an administrative function requiring backend access.

Affected ProductsAI

Langley FCU Online Banking System up to and including commit 57437e6400ce0ae240e692c24e6346b8d0c17d7a. The product uses a continuous rolling-release approach; therefore, no discrete version numbers are published by the vendor. The vulnerable component is the Add Customer Page functionality in /customer_add_action.php. Additional version or release date information is not available from the CVE record or vendor advisory.

RemediationAI

Due to the rolling-release model, apply the latest version of Langley FCU Online Banking System from the vendor's main development branch (post-commit 57437e6400ce0ae240e692c24e6346b8d0c17d7a). Specifically, ensure the /customer_add_action.php file implements HTML entity encoding (htmlspecialchars() or equivalent) on the First Name input field before output in web pages. As interim compensating controls: (1) restrict access to the Add Customer feature to a minimal set of trusted administrators with multi-factor authentication, (2) implement Content-Security-Policy headers prohibiting inline script execution, and (3) audit access logs for Add Customer page modifications. These controls mitigate the UI:P requirement by reducing the number of potential victims and the practical window for social engineering. Consult the vendor's GitHub repository (referenced in CVE links) for the latest patch branch or release notes.