EUVD-2025-18759Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to application
-
DeliverySubmit malicious recipe name via POST
-
ExploitServer stores unsanitized input
-
ExecutionVictim views recipe list
-
PersistXSS payload executes in victim's browser
-
ImpactAttacker achieves limited impact (VI:L)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be authenticated to the application (PR:L) and the victim must view the page containing the malicious recipe name (UI:P). No special configuration is required beyond default settings. |
| Impact | CVSS 4.0 base score is 2.0 (Low) with vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, indicating low impact. EPSS score is 0.05% (14th percentile), suggesting very low exploitation probability. A public POC exists but no KEV listing. The SSVC decision would likely be 'Low' priority due to low technical impact and low exploitation likelihood. The risk is minimal for most deployments. |
| Exploit ScenarioDerived | An authenticated attacker submits a crafted recipe name containing JavaScript payload via the Add Recipe form. When other users view the recipe list, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Stored cross-site scripting in SourceCodester My Food Recipe 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the Name parameter on the Add Recipe page. A public exploit exists, but EPSS score is low (0.05%) and no active exploitation has been reported.
Earlier versions of this analysis (1)
RemediationAI
Upgrade to a patched version if available; otherwise, sanitize the 'Name' input parameter on the Add Recipe page to prevent XSS. As a workaround, implement output encoding and input validation. No official patch version has been identified at this time.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a stored XSS (CWE-79) in a PHP-based recipe management application. The affected component is the Add Recipe page, where user-supplied input in the 'Name' field is not properly sanitized before being stored and later rendered in the browser. The CPE indicates the product is 'rems:my_food_recipe:1.0', a single version. The attack is performed via HTTP POST request to /endpoint/add-recipe.php.
Know when My Food Recipe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Requires authenticated access (PR:L) and user interaction (UI:R); low integrity impact only.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in SourceCodester My Food Recipe 1.0 and classified as problematic. Affected by this issue is the function addRecipeModal of the file /endpoint/add-recipe.php of the component Add Recipe Page. The manipulation of the argument Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
CVE-2025-6345 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 3.5). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB