CVE-2025-70890: XSS
A stored cross-site scripting (XSS) vulnerability exists in Cyber Cafe Management System v1.0. An authenticated attacker can inject arbitrary JavaScript code into the username parameter via the add-users.php endpoint. The injected payload is stored and executed in the victim s browser when the affected page is accessed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-70890?
CVE-2025-70890 is classified as a high severity stored cross-site scripting vulnerability.
How do I fix CVE-2025-70890?
To fix CVE-2025-70890, ensure user input is properly validated and sanitized before being processed.
Who is affected by CVE-2025-70890?
CVE-2025-70890 affects all instances of Cyber Cafe Management System version 1.0 that allow user input via the add-users.php endpoint.
Can CVE-2025-70890 be exploited remotely?
Yes, CVE-2025-70890 can be exploited remotely by an authenticated attacker through the affected add-users.php endpoint.
What can an attacker do with CVE-2025-70890?
An attacker can inject arbitrary JavaScript code that will be executed in the browser of other users who access the affected system.