projectworlds Expense Management System CVE-2025-12229

Immediate remediation requires contacting projectworlds for a patched version, as no public patch information is available in the provided data. As a compensating control, restrict administrative access to the /public/admin/roles/create endpoint to a minimal set of trusted administrators and implement IP whitelisting if possible, reducing the pool of potential attackers. Apply strong Content Security Policy (CSP) headers to prevent inline script execution and restrict script sources to trusted domains, mitigating XSS impact even if injection occurs. Implement input validation on the roles creation form to reject or sanitize special characters and HTML entities, and apply output encoding to all reflected data using context-appropriate encoding (HTML entity encoding for HTML context). Enable security auditing on administrative functions to detect suspicious role creation activity. Contact projectworlds for security updates and consider evaluating alternative expense management solutions if patches are not forthcoming.