CVE-2025-63712 is a Cross-Site Request Forgery (CSRF) vulnerability in the SourceCodester Product Expiry Management System. The vulnerability exists in the User Management module's delete-user.php endpoint, which allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests. This occurs because the endpoint relies solely on session cookies for authentication and lacks CSRF protection.