Which versions of My Food Recipe are affected by CVE-2025-6345?

CVE-2025-6345 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 3.5).

Is there a public PoC exploit available for CVE-2025-6345?

Yes, a public proof-of-concept exploit is available for CVE-2025-6345. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-6345?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

My Food Recipe CVE-2025-6345

Q: What is the CVSS score of CVE-2025-6345?

CVE-2025-6345 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-18759 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-06-20 cna@vuldb.com

PHP XSS My Food Recipe Rems

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.5 LOW

Requires authenticated access (PR:L) and user interaction (UI:R); low integrity impact only.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.5 (LOW) 2.0 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18759

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 26, 2025 - 14:46 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 15:15 cve.org

LOW 2.0

CVE Published

Jun 20, 2025 - 15:15 nvd

LOW 3.5

DescriptionCVE.org

A vulnerability was found in SourceCodester My Food Recipe 1.0 and classified as problematic. Affected by this issue is the function addRecipeModal of the file /endpoint/add-recipe.php of the component Add Recipe Page. The manipulation of the argument Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stored cross-site scripting in SourceCodester My Food Recipe 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the Name parameter on the Add Recipe page. A public exploit exists, but EPSS score is low (0.05%) and no active exploitation has been reported.

Technical ContextAI

The vulnerability is a stored XSS (CWE-79) in a PHP-based recipe management application. The affected component is the Add Recipe page, where user-supplied input in the 'Name' field is not properly sanitized before being stored and later rendered in the browser. The CPE indicates the product is 'rems:my_food_recipe:1.0', a single version. The attack is performed via HTTP POST request to /endpoint/add-recipe.php.

RemediationAI

Upgrade to a patched version if available; otherwise, sanitize the 'Name' input parameter on the Add Recipe page to prevent XSS. As a workaround, implement output encoding and input validation. No official patch version has been identified at this time.