high8.8
CVE-2025-63712
Cross-Site Request Forgery (CSRF) in SourceCodester Product Expiry Management System.
Impact
Cross-Site Request Forgery (CSRF) in SourceCodester Product Expiry Management System. The User Management module (delete-user.php) allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF protection.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Senior-Walter | Web-Based Pharmacy Product Management System | Version 1.0 |