CVE-2025-10566 Details

A cross-site scripting (XSS) vulnerability has been identified in Campcodes Grocery Sales and Inventory System version 1.0. The issue arises in the file '/index.php?page=users', where the 'page' parameter is not properly validated or encoded before being output to users. This flaw allows attackers to inject malicious scripts that are executed in the context of the victim's browser, potentially leading to the theft of cookies, session tokens, or other sensitive information. The vulnerability can be exploited remotely, without any authentication, although it requires user interaction from the victim.

It is recommended to implement proper output encoding for user inputs, validate and filter input data to reject or escape potentially malicious content, and consider using a Content Security Policy (CSP) to restrict the execution of unauthorized scripts. Additionally, setting secure and HttpOnly flags for sensitive cookies can help mitigate the risk of cookie theft.