Which versions of Restaurant Table Booking System are affected by CVE-2025-5970?

CVE-2025-5970 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 2.4).

Is there a public PoC exploit available for CVE-2025-5970?

Yes, a public proof-of-concept exploit is available for CVE-2025-5970. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5970?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

Restaurant Table Booking System CVE-2025-5970

Q: What is the CVSS score of CVE-2025-5970?

CVE-2025-5970 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-17760 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-06-10 cna@vuldb.com

PHP XSS Restaurant Table Booking System Phpgurukul

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.5 LOW

Requires admin privileges (PR:H) and user interaction (UI:R); low confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

2.4 (LOW) 1.9 (LOW)

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17760

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

PoC Detected

Jun 17, 2025 - 20:35 vuln.today

Public exploit code

CVE Published

Jun 10, 2025 - 17:25 cve.org

LOW 1.9

CVE Published

Jun 10, 2025 - 17:25 nvd

LOW 2.4

DescriptionCVE.org

A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/add-subadmin.php. The manipulation of the argument fullname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

AnalysisAI

Cross-site scripting (XSS) in PHPGurukul Restaurant Table Booking System 1.0 allows authenticated admin users to inject arbitrary web scripts via the 'fullname' parameter in /admin/add-subadmin.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.05%), indicating low exploitation likelihood.

Technical ContextAI

The vulnerability is a stored XSS (CWE-79) in a PHP-based restaurant booking application. The affected file /admin/add-subadmin.php processes the 'fullname' parameter without proper sanitization, allowing injection of malicious scripts. The CPE indicates the exact product and version: PHPGurukul Restaurant Table Booking System 1.0. The attack requires admin-level privileges (PR:H) and user interaction (UI:P), as the injected script executes when an admin views the affected page.

RemediationAI

No official patch has been released by the vendor. As a workaround, sanitize the 'fullname' parameter in /admin/add-subadmin.php by escaping HTML entities or using a whitelist. Alternatively, restrict access to the admin panel to trusted users only. Note that these mitigations may affect functionality if the parameter expects special characters.