CVE-2025-40641: Multi-Purpose Inventory Management System

Medium severity, CVSS 5.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Cross-site Scripting (XSS) vulnerability stored in Multi-Purpose Inventory Management System, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request using the product_name parameter in /Controller_Products/update. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

Affected products

• Multi-Purpose Inventory Management System Multi-Purpose Inventory Management System

Published 2025-09-08. Last modified 2026-06-17.