Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-9929: Code-projects Responsive Blog Site 1.0: Malicious code injection via blog post

CVE-2025-9929 · published 1 year ago

Summary

An attacker can inject malicious code into a blog post on Code-projects Responsive Blog Site 1.0, potentially allowing them to take control of the site. This could happen if an administrator or user clicks on a specially crafted link or uploads a malicious file. To protect your site, update to the latest version of the software or consider implementing security patches.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
fabian	responsive_blog_site	1.0 `cpe:2.3:a:fabian:responsive_blog_site:1.0:::::::*`

Original advisory text

A weakness has been identified in code-projects Responsive Blog Site 1.0. This affects an unknown function of the file blogs_view.php. Executing manipulation of the argument product_code/gen_name/product_name/supplier can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.

References

https://code-projects.org/ Product
https://github.com/chen2496088236/CVE/issues/5 Exploit Third Party Advisory
https://vuldb.com/?ctiid.322331 Permissions Required VDB Entry
https://vuldb.com/?id.322331 Third Party Advisory VDB Entry
https://vuldb.com/?submit.642586 Third Party Advisory VDB Entry

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

1.9 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

CWE-94Code Injection

Timeline

Published4 Sep 2025

Updated3 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-9929 · NVD

Track software like this

Free during beta