Cross Site Scripting Vulnerability in Wuzhicms by Wuzhicms
CVE-2025-25916

5.4MEDIUM

Key Information:

Vendor

Wuzhicms

Status
Wuzhicms
Vendor
CVE Published:
28 February 2025

What is CVE-2025-25916?

The del function in the coreframe app of Wuzhicms v4.1.0 exposes users to Cross Site Scripting (XSS) risks, enabling malicious scripts to execute in users' browsers. This vulnerability could potentially allow attackers to hijack user sessions, redirect users to malicious sites, or perform actions on behalf of the user, compromising the integrity and confidentiality of sensitive data.

References

https://github.com/wuzhicms/wuzhicms/issues/213
https://gist.github.com/A7cc/e28b5790d8b40df8d418d1bd15c2...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.