CVE-2025-60280

Cross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code into the application's web pages. This vulnerability exists due to insufficient input sanitization or output encoding, allowing attacker-controlled input to be rendered directly in the browser. When exploited, an attacker can steal session cookies, redirect users to malicious sites, perform actions on behalf of the user, or deface the website. This can lead to user data compromise, loss of user trust, and a broader attack surface for more advanced exploitation techniques.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/debug-security/CVE/tree/main/CVE-2025-60280	Exploit Third Party Advisory
https://vwrap.live/stored-xss-in-bangresto	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hockeycomputindo:bang_resto:1.0:*:*:*:*:*:*:*

History

05 Nov 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de Cross-Site Scripting (XSS) en Bang Resto v1.0 podría permitir a un atacante inyectar código JavaScript malicioso en las páginas web de la aplicación. Esta vulnerabilidad existe debido a una sanitización de entrada o codificación de salida insuficiente, permitiendo que la entrada controlada por el atacante sea renderizada directamente en el navegador. Cuando se explota, un atacante puede robar cookies de sesión, redirigir a los usuarios a sitios maliciosos, realizar acciones en nombre del usuario o desfigurar el sitio web. Esto puede llevar al compromiso de datos del usuario, la pérdida de confianza del usuario y una superficie de ataque más amplia para técnicas de explotación más avanzadas.

Information

Published : 2025-10-21 16:15

Updated : 2026-11-05 22:10

NVD link : CVE-2025-60280

Mitre link : CVE-2025-60280

CVE.ORG link : CVE-2025-60280

JSON object : View

Products Affected

hockeycomputindo

bang_resto

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-60280", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-60280", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-21T16:01:56.618919Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-10-21T16:15:38.257", "references": [{"url": "https://github.com/debug-security/CVE/tree/main/CVE-2025-60280", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://vwrap.live/stored-xss-in-bangresto", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-Site Scripting (XSS) vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code into the application's web pages. This vulnerability exists due to insufficient input sanitization or output encoding, allowing attacker-controlled input to be rendered directly in the browser. When exploited, an attacker can steal session cookies, redirect users to malicious sites, perform actions on behalf of the user, or deface the website. This can lead to user data compromise, loss of user trust, and a broader attack surface for more advanced exploitation techniques."}, {"lang": "es", "value": "Una vulnerabilidad de Cross-Site Scripting (XSS) en Bang Resto v1.0 podr\u00eda permitir a un atacante inyectar c\u00f3digo JavaScript malicioso en las p\u00e1ginas web de la aplicaci\u00f3n. Esta vulnerabilidad existe debido a una sanitizaci\u00f3n de entrada o codificaci\u00f3n de salida insuficiente, permitiendo que la entrada controlada por el atacante sea renderizada directamente en el navegador. Cuando se explota, un atacante puede robar cookies de sesi\u00f3n, redirigir a los usuarios a sitios maliciosos, realizar acciones en nombre del usuario o desfigurar el sitio web. Esto puede llevar al compromiso de datos del usuario, la p\u00e9rdida de confianza del usuario y una superficie de ataque m\u00e1s amplia para t\u00e9cnicas de explotaci\u00f3n m\u00e1s avanzadas."}], "lastModified": "2026-11-05T22:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hockeycomputindo:bang_resto:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E00A0E16-145F-4356-9B38-1BE60D2E4EAB"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}