CVE-2025-56605

XSS (Cross-Site Scripting Vulnerability)

CVE-2025-56605 — Reflected XSS in Event Management System 1.0

Description:
A reflected Cross-Site Scripting (XSS) vulnerability exists in register.php of PuneethReddyHC/event-management 1.0.
The mobile POST parameter is improperly validated and reflected back in the response, allowing injection of arbitrary JavaScript code.

CVE ID: CVE-2025-56605
Discovered by: Isroil Mustafoqulov
Vulnerability type: Reflected XSS
Attack vector: Remote

Steps to reproduce (local only):

1. Clone the project and run it locally.
2. Send a crafted POST request to backend/register.php with a malicious payload in the mobile parameter.
3. The payload is reflected unsanitized in the response.

⚠️ Payloads are intentionally omitted. Do not attempt exploitation on systems you do not own.

Sanitize/encode user input before output. Example in PHP: