CVE-2025-15451
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability in xnx3 wangmarket up to 4.9, affecting an unknown function in the file /admin/system/variableSave.do of the System Variables Page component. Manipulation of the Description argument leads to cross-site scripting (XSS). The attack can be initiated remotely. The exploit has been released publicly.
Risk Assessment
XSS attack may allow execution of malicious scripts in the application context, potentially leading to data theft or admin session hijacking.
Recommendation
Update wangmarket to the latest version if available, or apply other mitigations such as input validation.
Other vulnerabilities in wangmarket
See all- CVE-2025-15452Low
A vulnerability in xnx3 wangmarket up to 4.9, affecting the function variableList in the file /admin/system/variableList.do of the Backend Variable Search component. Manipulation of the Description argument leads to cross-site scripting (XSS). The attack can be launched remotely. The exploit has been made public.
- CVE-2025-15416Low
A cross-site scripting (XSS) vulnerability exists in xnx3 wangmarket up to 6.4 in an unknown function of /siteVar/save.do (Add Global Variable Handler component). Manipulation of the Remark/Variable Value argument leads to XSS. The attack can be executed remotely and the exploit is public.
- CVE-2025-15415Medium
An unrestricted upload vulnerability was found in wangmarket up to 6.4, in the uploadImage function of the file /sits/uploadImage.do. Manipulating the image argument allows remote exploitation.
Original NVD description (English source)
A security flaw has been discovered in xnx3 wangmarket up to 4.9. Affected by this issue is some unknown functionality of the file /admin/system/variableSave.do of the component System Variables Page. Performing a manipulation of the argument Description results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS