CVE-2025-9237mediumCWE-79CWE-94

CVE-2025-9237: medium-severity vulnerability in CodeAstro Ecommerce Website

CodeAstro Ecommerce Website Edit Your Account my_account.php cross site scripting

Published

Follow this CVE+ Monitor Ecommerce Website

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.3%
A vulnerability was found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /customer/my_account.php?edit_account of the component Edit Your Account Page. Performing manipulation of the argument Username results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
CodeAstro · Ecommerce Website
Related CVEs — CodeAstro Ecommerce Website

In the same product, most dangerous first.

CVE-2026-14799MEDIUMCodeAstro Ecommerce Website my_account.php sql injectionEPSS 0.3%CVE-2026-14767MEDIUMCodeAstro Ecommerce Website POST Parameter confirm.php sql injectionEPSS 0.3%CVE-2026-14639MEDIUMCodeAstro Ecommerce Website my_account.php sql injectionEPSS 0.3%