EUVD-2025-17115Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to application
-
DeliverySubmit malicious payload in /save-reported.php
-
ExploitPayload stored in database
-
ExecutionVictim views report
-
PersistScript executes in victim's browser
-
ImpactSteal session or perform actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be authenticated (PR:L) and the victim must view the crafted report (UI:P). No special configuration is required beyond default installation. The attack is limited to stored XSS within the application's context. |
| Impact | CVSS 4.0 base score is 2.0 (Low) with vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, indicating low impact. EPSS probability is 0.05% (16th percentile), suggesting very low exploitation likelihood. Public POC exists but no KEV listing. The SSVC decision would likely be 'low' priority due to low technical impact and low exploitation probability. The risk is minimal for most deployments. |
| Exploit ScenarioDerived | An authenticated attacker submits a malicious payload in the 'name' field of the traffic offense report form. When an administrator views the report, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf. Public exploit code is available on GitHub. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Stored cross-site scripting in code-projects Traffic Offense Reporting System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via multiple parameters in /save-reported.php. Public exploit code exists, but EPSS score is low (0.05%) and no active exploitation has been reported.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch identified at time of analysis. As a workaround, implement input validation and output encoding for all parameters in /save-reported.php. Specifically, sanitize the fields offence_id, vehicle_no, driver_license, name, address, gender, officer_reporting, and offence using HTML entity encoding or a security library. Restrict access to the application to trusted users only. Note that these mitigations may require code changes and could affect functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a stored XSS (CWE-79) in a PHP-based web application for reporting traffic offenses. The affected file /save-reported.php does not sanitize user-supplied input for fields such as offence_id, vehicle_no, driver_license, name, address, gender, officer_reporting, and offence. The CPE indicates the product is Traffic Offense Reporting System version 1.0 from vendor Carmelo.
Know when Traffic Offense Reporting System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Requires authentication and user interaction; low confidentiality and integrity impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in code-projects Traffic Offense Reporting System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /save-reported.php. The manipulation of the argument offence_id/vehicle_no/driver_license/name/address/gender/officer_reporting/offence leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
CVE-2025-5757 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 3.5). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
A vulnerability, which was classified as problematic, has been found in code-projects Traffic Offense Reporting System 1
A vulnerability, which was classified as problematic, was found in code-projects Traffic Offense Reporting System 1.0. T
Cross-site request forgery in code-projects Traffic Offense Reporting System 1.0 allows an attacker to perform unauthori
Exploit-DB