What is the CVSS score of CVE-2025-65341?

CVE-2025-65341 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Ecommerce Fruits Bazar CVE-2025-65341

EUVD-2025-210560 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 mitre

GHSA-5c54-r373-6r66

XSS PHP N A

6.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Attacker needs no privileges (PR:N); admin victim interaction mandatory (UI:R); script executes in admin browser context crossing scope boundary (S:C); no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:40 vuln.today

CVE Published

Jul 30, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php.

AnalysisAI

Reflected cross-site scripting in Ecommerce Fruits Bazar 1.0 allows a remote unauthenticated attacker to inject malicious JavaScript into the admin panel via the admin/edit_product.php endpoint, with execution occurring in the context of an authenticated administrator's browser session. The scope-changed CVSS vector (S:C) confirms the payload escapes the server's security context into the victim browser, enabling session hijacking or credential theft against administrative users. A proof-of-concept exists in the TaintRadar vulnerability research repository; EPSS is 0.14% (4th percentile), indicating no widespread automated exploitation observed to date.

Technical ContextAI

Ecommerce Fruits Bazar is a PHP-based web storefront application. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning the application fails to sanitize or encode attacker-controlled input before rendering it in an HTML context within admin/edit_product.php. The CVSS S:C (Scope Changed) flag is characteristic of XSS: the injected script executes in the victim's browser under the admin origin, crossing the trust boundary from server to client. CPE data provided by NVD (cpe:2.3:a:n/a:n/a) is unpopulated, indicating the vendor is not registered in the NVD CPE dictionary, consistent with a very small or hobby-level open-source project. The TaintRadar PoC reference is from academic taint-analysis research targeting PHP applications.

RemediationAI

No vendor-released patch has been identified at time of analysis; the project appears unmaintained with no associated vendor advisory. Operators running Ecommerce Fruits Bazar 1.0 should apply input sanitization and output encoding to all user-controlled parameters rendered in admin/edit_product.php, specifically using PHP's htmlspecialchars() with ENT_QUOTES on all echoed variables - this eliminates the XSS sink without changing application behavior. As a compensating control, restrict access to the /admin/ directory to trusted IP ranges via web server configuration (e.g., Apache Allow/Deny directives or nginx geo module), which prevents an attacker from even reaching the vulnerable endpoint. Additionally, implementing a Content Security Policy (CSP) header with script-src 'self' will block inline script execution even if a payload is injected, though this may break any inline JavaScript the application legitimately uses. Given the project's apparent lack of active maintenance, replacing it with a supported ecommerce platform is the most durable remediation.