CVE-2025-63712

High · 8.8

CVSS

8.8

EPSS

0.2%

Published

Nov 10, 2025

CISA due date

—

The record

Cross-Site Request Forgery (CSRF) in SourceCodester Product Expiry Management System. The User Management module (delete-user.php) allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF protection.

Affected packages

Ecosystem	Package	Introduced	Fixed