PT-2025-48370 · Xmall · Xmall

Ylchen-007 · Published 2025-11-29 · Updated 2025-11-29 · CVE-2025-65540

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions xmall version 1.1

Description Multiple Cross-Site Scripting (XSS) issues are present due to improper handling of user-supplied data. User input fields, including username and description, are directly rendered into HTML without appropriate sanitization or encoding. This allows attackers to inject and execute malicious scripts.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65540

Affected Products

Xmall

References · 7

• 🔥 https://github.com/Exrick/xmall/issues/101 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65540 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65540 · Vendor Advisory
• https://t.me/CVEtracker/38465 · Telegram Post
• https://twitter.com/CVEnew/status/1994613187639951794 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1994651598748786887 · Twitter Post
• https://t.me/cveNotify/144321 · Telegram Post