CVE-2025-1817

4.8 mediumEPSS 0.4%

A vulnerability classified as problematic was found in Mini-Tmall up to 20250211. This vulnerability affects unknown code of the file /admin of the component Admin Name Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Severity

CVSS 4.0

4.8 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-94
Published: 2025-03-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

projectteam:mini-tmall

References

https://github.com/qkdjksfkeg/cve_article/blob/main/Tmall_demo/XSS.md
https://vuldb.com/?ctiid.298090
https://vuldb.com/?id.298090
https://vuldb.com/?submit.504302
https://github.com/qkdjksfkeg/cve_article/blob/main/Tmall_demo/XSS.md

Check your stack JSON