CVE-2025-2085: medium-severity vulnerability in StarSea99 starsea-mall
StarSea99 starsea-mall save cross site scripting
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.3%
A vulnerability classified as problematic has been found in StarSea99 starsea-mall 1.0. This affects an unknown part of the file /admin/carousels/save. The manipulation of the argument redirectUrl leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
StarSea99 · starsea-mallRelated CVEs — StarSea99 starsea-mall
In the same product, most dangerous first.
CVE-2025-2089MEDIUMStarSea99 starsea-mall com.siro.mall.controller.mall.UserController updateInfo updateUserInfo access controlEPSS 0.5%CVE-2025-0399MEDIUMStarSea99 starsea-mall uploadController.java UploadController unrestricted uploadEPSS 0.4%CVE-2025-2087MEDIUMStarSea99 starsea-mall update cross site scriptingEPSS 0.4%CVE-2025-2086MEDIUMStarSea99 starsea-mall update cross site scriptingEPSS 0.4%CVE-2025-2352MEDIUMStarSea99 starsea-mall Backend save cross site scriptingEPSS 0.3%CVE-2025-0400MEDIUMStarSea99 starsea-mall update cross site scriptingEPSS 0.3%