CVE-2025-12244

The vulnerability is a stored cross-site scripting (XSS) issue in the register.php file of code-projects Simple E-Banking System 1.0. The Username parameter is not sanitized before being stored and later echoed in the registration process [1].

An attacker can register a username containing malicious JavaScript, such as ``. When the system processes the registration, the script is executed in the browser of any user visiting the page that displays the username [1]. The attack is remote and does not require authentication.

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to theft of cookies, session tokens, or other sensitive information [1].

The vendor has not released a patch as of publication. Users should sanitize input or apply proper encoding. The exploit is publicly available [1].