CVE-2025-60302: code-projects Client Details System XSS in username field

CVE-2025-60302 · Severity: medium · CVSS 6.1 · Published 2025-10-09

The code-projects Client Details System, a web application used for managing customer information, contains a security flaw that allows attackers to inject malicious scripts. By entering specially crafted text into the username field when adding a new customer, an attacker can execute code in the browser of an administrator who views that record. This could lead to the theft of administrative login sessions or unauthorized actions performed on behalf of the administrator.

Technologies: Fabian Client Details System. Vendors: Fabian.

Quick answers

Is CVE-2025-60302 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-60302 being exploited in the wild.
How severe is CVE-2025-60302?
Medium severity, with a CVSS score of 6.1, published 9 October 2025.
Which products and versions are affected?
code-projects Client Details System 1.0.
Is there a fix for CVE-2025-60302?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-60302 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-60302?
Check whether you run Fabian Client Details System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Client Details System 1.0. The application fails to properly sanitize or neutralize user-supplied input in the 'username' field during the customer creation process. An unauthenticated or low-privileged attacker can submit a payload containing malicious JavaScript. When an administrative user later views the customer details, the script executes in their browser context. This can be leveraged to steal session cookies (document.cookie) or perform unauthorized administrative actions. The vulnerability is tracked as CVE-2025-60302.

Affected products

  • code-projects Client Details System 1.0

Timeline

  • 2025-10-09: disclosed
  • 2025-10-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.