What’s Vulnerable › Vulnerabilities

CVE-2025-60280

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-10-21 · updated 2026-06-17
• Weakness: CWE-79

Description

Cross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code into the application's web pages. This vulnerability exists due to insufficient input sanitization or output encoding, allowing attacker-controlled input to be rendered directly in the browser. When exploited, an attacker can steal session cookies, redirect users to malicious sites, perform actions on behalf of the user, or deface the website. This can lead to user data compromise, loss of user trust, and a broader attack surface for more advanced exploitation techniques.

Affected products

• Hockeycomputindo Bang Resto: 1.0

References

• https://github.com/debug-security/CVE/tree/main/CVE-2025-60280
• https://vwrap.live/stored-xss-in-bangresto

Get alerted when CVE-2025-60280 or the next vulnerability affects your stack