CVE-2025-8191mediumCWE-79CWE-94

CVE-2025-8191: medium-severity vulnerability in macrozheng mall

macrozheng mall Swagger UI index.html cross site scripting

Published · Updated

Follow this CVE+ Monitor mall

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.1epss 1.8%
from disclosure to weaponsame day
Published on NVDJul 26
1st PoCJan 10
A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
macrozheng · mall
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — macrozheng mall

In the same product, most dangerous first.

CVE-2024-11619LOWmacrozheng mall JWT Token default keyEPSS 0.7%CVE-2026-25858CRITICALmacrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP DisclosureEPSS 0.7%CVE-2025-8742MEDIUMmacrozheng mall Admin Login excessive authenticationEPSS 0.7%CVE-2025-8755MEDIUMmacrozheng mall com.macro.mall.portal.controller UmsMemberController.java detail authorizationEPSS 0.6%CVE-2025-8741MEDIUMmacrozheng mall login cleartext transmissionEPSS 0.4%CVE-2026-19361MEDIUMmacrozheng mall mall-portal getAuthCode password recoveryEPSS 0.4%