CVE-2025-15416
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability exists in xnx3 wangmarket up to 6.4 in an unknown function of /siteVar/save.do (Add Global Variable Handler component). Manipulation of the Remark/Variable Value argument leads to XSS. The attack can be executed remotely and the exploit is public.
Risk Assessment
An attacker could execute malicious script in a user's browser, stealing sessions or performing actions on behalf of the victim. The vendor has not responded, increasing the risk.
Recommendation
Upgrade wangmarket beyond 6.4 if available, or implement input validation and sanitization for the Remark/Variable Value arguments. Consider deploying CSP headers.
Other vulnerabilities in wangmarket
See all- CVE-2025-15452Low
A vulnerability in xnx3 wangmarket up to 4.9, affecting the function variableList in the file /admin/system/variableList.do of the Backend Variable Search component. Manipulation of the Description argument leads to cross-site scripting (XSS). The attack can be launched remotely. The exploit has been made public.
- CVE-2025-15451Low
A vulnerability in xnx3 wangmarket up to 4.9, affecting an unknown function in the file /admin/system/variableSave.do of the System Variables Page component. Manipulation of the Description argument leads to cross-site scripting (XSS). The attack can be initiated remotely. The exploit has been released publicly.
- CVE-2025-15415Medium
An unrestricted upload vulnerability was found in wangmarket up to 6.4, in the uploadImage function of the file /sits/uploadImage.do. Manipulating the image argument allows remote exploitation.
Original NVD description (English source)
A vulnerability was found in xnx3 wangmarket up to 6.4. This affects an unknown function of the file /siteVar/save.do of the component Add Global Variable Handler. The manipulation of the argument Remark/Variable Value results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS