CVE-2025-63712: senior-walter web-based_pharmacy_product_management_system Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2025-63712 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in senior-walter web-based_pharmacy_product_management_system. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-11-2025
   PublishedVulnerability first disclosed.
2. 18-11-2025
   Last modifiedVulnerability information updated.

Description

Cross-Site Request Forgery (CSRF) in SourceCodester Product Expiry Management System. The User Management module (delete-user.php) allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF protection.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.