projectworlds Expense Management System CVE-2025-12229

Exploitation requires the attacker to possess high-privilege (admin-level) authentication credentials to access the /public/admin/roles/create endpoint. Additionally, the vulnerable endpoint must be accessible over the network without additional authentication barriers beyond the login mechanism. A legitimate administrator or other user must view or interact with the injected content (via the Roles Page display or edit functionality) for the XSS payload to execute in their browser, meaning the attack cannot proceed without user interaction on the victim side. Non-high-privilege users cannot access the vulnerable endpoint. The vulnerability does not execute automatically upon injection; a second user must interact with the stored malicious content for it to trigger.

Despite a low CVSS score of 1.9, this vulnerability presents moderate real-world risk due to conflicting signals. The CVSS vector (PR:H, UI:P, VC:N, VI:L) correctly reflects that exploitation requires high-privilege authentication and user interaction, with limited integrity impact. However, the EPSS score of 0.03% (9th percentile) indicates very low likelihood of mass exploitation, consistent with the stringent prerequisites. Public POC availability increases risk for targeted attacks against organizations where high-privilege users are compromised or malicious insiders exist. The low CVSS aligns with exploitation difficulty, suggesting this is not a critical priority but warrants remediation as part of routine patching. The real risk lies in insider threats or privilege escalation chains where an attacker with admin-level access injects malicious scripts to compromise other administrators.

A disgruntled administrator with high-privilege access to the Expense Management System navigates to the Roles Page and creates a new role, injecting a malicious script payload in the role name or description field. When another administrator views the list of roles or attempts to edit the newly created role, the malicious script executes in their browser, potentially stealing their session cookie, redirecting them to a phishing site, or performing unauthorized actions on their behalf. The attacker used the public POC from GitHub to craft the payload.