CVE-2025-40641 — Stored Cross-Site Scripting (XSS) in the Multi-purpose Inventory Management System

CVE-2025-40641

Stored Cross-Site Scripting (XSS) in the Multi-purpose Inventory Management System PUBLISHED

Description (CNA)

Cross-site Scripting (XSS) vulnerability stored in Multi-Purpose Inventory Management System, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request using the product_name parameter in /Controller_Products/update. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

Affected (CNA)

Vendor / product	Versions
Multi-Purpose Inventory Management System / Multi-Purpose Inventory Management System	affected Non-defining

CWE

CWE-79

References

https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-multi-purpose-inventory-management-system

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.