CVE-2025-15452
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability in xnx3 wangmarket up to 4.9, affecting the function variableList in the file /admin/system/variableList.do of the Backend Variable Search component. Manipulation of the Description argument leads to cross-site scripting (XSS). The attack can be launched remotely. The exploit has been made public.
Risk Assessment
XSS attack may allow execution of malicious scripts in the application context, potentially leading to data theft or admin session hijacking.
Recommendation
Update wangmarket to the latest version if available, or apply other mitigations such as input validation.
Other vulnerabilities in wangmarket
See all- CVE-2025-15451Low
A vulnerability in xnx3 wangmarket up to 4.9, affecting an unknown function in the file /admin/system/variableSave.do of the System Variables Page component. Manipulation of the Description argument leads to cross-site scripting (XSS). The attack can be initiated remotely. The exploit has been released publicly.
- CVE-2025-15416Low
A cross-site scripting (XSS) vulnerability exists in xnx3 wangmarket up to 6.4 in an unknown function of /siteVar/save.do (Add Global Variable Handler component). Manipulation of the Remark/Variable Value argument leads to XSS. The attack can be executed remotely and the exploit is public.
- CVE-2025-15415Medium
An unrestricted upload vulnerability was found in wangmarket up to 6.4, in the uploadImage function of the file /sits/uploadImage.do. Manipulating the image argument allows remote exploitation.
Original NVD description (English source)
A weakness has been identified in xnx3 wangmarket up to 4.9. This affects the function variableList of the file /admin/system/variableList.do of the component Backend Variable Search. Executing a manipulation of the argument Description can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS