Cyber Posture

CVE-2025-0530

LowPublic PoC

Published: 17 January 2025

Published
17 January 2025
Modified
03 March 2025
KEV Added
Patch
CVSS Score 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
EPSS Score 0.0014 34.2th percentile
Risk Priority 7 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-0530 is a low-severity Cross-site Scripting (CWE-79) vulnerability in Anisha Job Recruitment. Its CVSS base score is 3.5 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-10 directly prevents XSS by validating the manipulated 'type' argument in /_parse/_feedback_system.php to ensure only expected inputs are processed.

prevent

SI-15 comprehensively mitigates reflected XSS by filtering outputs generated from the unneutralized 'type' input before rendering in web pages.

prevent

SI-2 addresses the root cause by identifying and remediating the improper neutralization flaw in the Job Recruitment application's feedback system code.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
Why these techniques?

XSS vulnerability in public-facing web application enables exploitation for initial access (T1190) and malicious JavaScript execution (T1059.007) as mapped by VulDB.

NVD Description

A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. This vulnerability affects unknown code of the file /_parse/_feedback_system.php. The manipulation of the argument type leads to cross site scripting. The attack can be initiated remotely.…

more

The exploit has been disclosed to the public and may be used.

Deeper analysisAI

CVE-2025-0530 is a cross-site scripting (XSS) vulnerability in code-projects Job Recruitment 1.0, affecting unknown code within the file /_parse/_feedback_system.php. The flaw stems from manipulation of the "type" argument, resulting in reflected XSS, and is classified as problematic with a CVSS v3.1 base score of 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N). It is associated with CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code).

A remote attacker with low privileges can exploit this vulnerability by manipulating the "type" argument, though it requires user interaction to succeed. Exploitation enables limited integrity impact, such as injecting malicious scripts into web pages viewed by users, potentially leading to session hijacking or phishing in the context of the application's feedback system.

Advisories reference the project site at code-projects.org, a GitHub repository containing exploit details at github.com/ha0day125/cve/blob/main/xss-ha0day.md, and multiple VulDB entries (vuldb.com/?ctiid.292414, vuldb.com/?id.292414, vuldb.com/?submit.478674). The exploit has been publicly disclosed and may be used by attackers. No patches or specific mitigations are detailed in the available information.

Details

CWE(s)

Affected Products

anisha
job recruitment
1.0

CVEs Like This One

CVE-2025-1162Same product: Anisha Job Recruitment
CVE-2025-0934Same product: Anisha Job Recruitment
CVE-2025-0168Same product: Anisha Job Recruitment
CVE-2025-7211Same vendor: Anisha
CVE-2025-15407Same vendor: Anisha
CVE-2025-7411Same vendor: Anisha
CVE-2025-0563Same vendor: Anisha
CVE-2025-7410Same vendor: Anisha
CVE-2025-7409Same vendor: Anisha
CVE-2025-15409Same vendor: Anisha

References