CVE-2025-60314

low-risk
Published 2025-10-08

Configuroweb Sistema Web de Inventario 1.0 is vulnerable to a Stored Cross-Site Scripting (XSS) due to the lack of input sanitization on the product name parameter (Nombre:Producto) allowing an authenticated attacker to inject malicious payloads and execute arbitrary JavaScript.

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Simple Web Inventory System

Affected Vendors

Configuroweb

References (3)

Product https://configuroweb.com/sistema-web-de-inventario-simple-en-php-mysql/
Exploit https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-603...
Product https://github.com/configuroweb/inventariobasico
26
/ 100
low-risk
Severity 21/34 · High
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal