CVE-2025-15583
detronetdip E-commerce function.php get_safe_value cross site scripting
- State
- Published
- Severity
- 5.1 Medium
- Published
- Feb 20, 2026
- Updated
- Feb 23, 2026
- Reserved
- Feb 18, 2026
Description
A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file utility/function.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 3.5 Low | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 3.5 Low | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
E-commercedetronetdip |
|
References
- VDB-346487 | detronetdip E-commerce function.php get_safe_value cross site scriptingvdb-entrytechnical-description
- VDB-346487 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #754033 | detronetdip E-commerce 1.0 Cross-Site Scripting (XSS)third-party-advisory
- https://github.com/detronetdip/E-commerce/issues/23issue-tracking
- https://github.com/Nixon-H/PHP-Stored-XSS-Bypass-Real-Escapeexploit
- https://github.com/detronetdip/E-commerce/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.