projectworlds Expense Management System CVE-2025-12228

The attacker must possess valid administrator credentials (PR:H in CVSS vector). The vulnerability is triggered only when the crafted payload is submitted via the /public/admin/users/create endpoint and subsequently viewed by another user (UI:P - user interaction required on the victim side). No special product configuration is documented as required; the default Users Page functionality in version 1.0 is vulnerable. Exploitation is blocked if the targeted system enforces strong content security policies or if administrator privileges are properly restricted. Web application firewalls or input validation rules that strip or escape HTML/JavaScript may also prevent exploitation.

Real-world risk is LOW despite a publicly available POC. CVSS 1.9 and EPSS 0.03% (9th percentile) converge on minimal practical danger. The attack chain requires (1) administrator-level privileges (PR:H), (2) user interaction from victims (UI:P), and (3) stored XSS impact limited to information disclosure (VI:L, no confidentiality, integrity, or availability impact to the system itself). Exploitability is further constrained: an attacker must already have compromised high-privilege credentials to inject the payload. While the CVE is confirmed in public databases and a POC exists, the combination of privilege requirements and interaction dependency means this is unlikely to be exploited at scale. SSVC framework would classify this as unlikely to have significant technical impact for most deployments.

An attacker with compromised administrator credentials navigates to /public/admin/users/create and injects malicious JavaScript into a user creation form field (e.g., user name or description). When other administrators or users view the Users Page listing, the injected script executes in their browsers, potentially stealing session cookies, redirecting to phishing sites, or performing actions on their behalf.