PT-2025-33620 · Unknown · Express Gateway

Haoatao · Published 2025-08-17 · Updated 2025-08-18 · CVE-2025-9095

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: ExpressGateway versions up to 1.16.10

Description: A flaw has been found in ExpressGateway affecting processing within the lib/rest/routes/users.js library of the REST Endpoint component. Manipulation of this component can lead to cross site scripting (XSS). The attack can be initiated remotely. The exploit has been publicly disclosed and may be used. The vendor was contacted regarding this issue but did not respond.

Recommendations: Versions prior to 1.16.10 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-9095

GHSA-Q4RG-7CJJ-5R86

Affected Products

Express Gateway

References · 12

• 🔥 https://github.com/freshfish-hust/my-cves/issues/5#issue-3286622393 · Exploit
• 🔥 https://github.com/freshfish-hust/my-cves/issues/5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9095 · Security Note
• https://osv.dev/vulnerability/GHSA-q4rg-7cjj-5r86 · Vendor Advisory
• https://github.com/ExpressGateway/express-gateway · Note
• https://t.me/cveNotify/132602 · Telegram Post
• https://vuldb.com/?ctiid.320417 · Note
• https://t.me/CVEtracker/30245 · Telegram Post
• https://vuldb.com/?id.320417 · Note
• https://vuldb.com/?submit.627709 · Note
• https://twitter.com/VulmonFeeds/status/1957224135496479073 · Twitter Post
• https://twitter.com/CVEnew/status/1957219725580399046 · Twitter Post