Is there a public PoC exploit available for CVE-2025-14221?

Yes, a public proof-of-concept exploit is available for CVE-2025-14221. Prioritise patching immediately. EPSS: 0.0%.

Online Banking System CVE-2025-14221

Q: What is the CVSS score of CVE-2025-14221?

CVE-2025-14221 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-201668 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-12-08 cna@vuldb.com

XSS Banking System Oretnom23

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.5 LOW

Requires authenticated user and user interaction to trigger, so PR:L and UI:R; only integrity impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.5 (LOW) 2.0 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 17:54 euvd

EUVD-2025-201668

Analysis Generated

Mar 15, 2026 - 17:54 vuln.today

PoC Detected

Dec 09, 2025 - 20:19 vuln.today

Public exploit code

CVE Published

Dec 08, 2025 - 07:15 nvd

LOW 3.5

CVE Published

Dec 08, 2025 - 07:15 cve.org

LOW 2.0

DescriptionCVE.org

A vulnerability was detected in SourceCodester Online Banking System 1.0. This impacts an unknown function of the file /?page=user. The manipulation of the argument First Name/Last Name results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used.

AnalysisAI

Reflected cross-site scripting in SourceCodester Online Banking System 1.0 allows remote attackers to inject scripts via the First Name or Last Name parameter on the user page. Exploit code is publicly available, though no active exploitation has been confirmed and EPSS indicates very low exploitation probability.

Technical ContextAI

The vulnerability is a classic reflected XSS (CWE-79) in a PHP-based banking application. The file /?page=user processes user-supplied input for First Name and Last Name without proper output encoding or input validation, allowing malicious scripts to be reflected back to the browser. The affected product is identified by CPE as oretnom23:banking_system:1.0, a simple online banking platform often used for educational purposes.

RemediationAI

No vendor patch has been released. As a workaround, apply strict input validation and output encoding to the First Name and Last Name fields on the user page-sanitize input by escaping or stripping HTML/JavaScript. Deploy a Content Security Policy header that disallows inline scripts and restricts script sources. A Web Application Firewall rule can block known XSS patterns. If the user page is not essential, disable it to eliminate the attack surface. Note: these mitigations may break legitimate functionality if not implemented carefully.