CVE-2025-8191mediumCWE-79CWE-94

CVE-2025-8191: falha de média gravidade em macrozheng mall

macrozheng mall Swagger UI index.html cross site scripting

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar mall

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

33Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 5.1epss 1.8%
da publicação à armano mesmo dia
Publicada no NVD26 de jul.
1ª PoC10 de jan.
A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
macrozheng · mall
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — macrozheng mall

No mesmo produto, das mais perigosas para as menos.

CVE-2024-11619LOWmacrozheng mall JWT Token default keyEPSS 0.7%CVE-2026-25858CRITICALmacrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP DisclosureEPSS 0.7%CVE-2025-8742MEDIUMmacrozheng mall Admin Login excessive authenticationEPSS 0.7%CVE-2025-8755MEDIUMmacrozheng mall com.macro.mall.portal.controller UmsMemberController.java detail authorizationEPSS 0.6%CVE-2025-8741MEDIUMmacrozheng mall login cleartext transmissionEPSS 0.4%CVE-2026-19361MEDIUMmacrozheng mall mall-portal getAuthCode password recoveryEPSS 0.4%