PT-2025-39366 · Ip.Php+1 · Php-Mip+1

Dev03303 · Published 2025-09-25 · Updated 2025-09-25 · CVE-2025-10944

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions yi-ge get-header-ip versions prior to 589b23d0eb0043c310a6a13ce4bbe2505d0d0b15

Description A cross-site scripting issue exists due to manipulation of the callback argument within the ip function of the ip.php file. This allows for remote attacks. The product uses a rolling release model, and specific version information for affected or updated releases is not available.

Recommendations Update to a version prior to 589b23d0eb0043c310a6a13ce4bbe2505d0d0b15. As a temporary workaround, consider restricting the use of the ip function in the ip.php file until a suitable update is available. Avoid using the callback argument in the ip function.

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-10944

Affected Products

Php-Mip

Yi-Ge

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-10944 · Security Note
• https://github.com/yi-ge/get-header-ip/blob/master/ip.php#L32 · Note
• https://vuldb.com/?ctiid.325814 · Note
• https://vuldb.com/?submit.651884 · Note
• https://twitter.com/VulmonFeeds/status/1971212677478224077 · Twitter Post
• https://t.me/cveNotify/136382 · Telegram Post
• https://vuldb.com/?id.325814 · Note
• https://twitter.com/CVEnew/status/1971199926785741208 · Twitter Post