PT-2025-50613 · Unknown · Baowzh Hfly+1

Webray.Com.Cn · Published 2025-12-11 · Updated 2026-01-06 · CVE-2025-14519

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions baowzh hfly versions prior to 638ff9abe9078bc977c132b37acbe1900b63491c

Description A security flaw exists due to cross site scripting in the processing of the /admin/index.php/advtext/add file within the advtext Module. The attack can be carried out remotely. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-14519

Affected Products

Advtext Module

Baowzh Hfly

References · 8

• 🔥 https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/PHP-based%20travel%20website-CMS/PHP-based%20travel%20website-CMS%20advtext%20add%20Stored%20Cross-Site%20Scripting(XSS).md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14519 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14519 · Vendor Advisory
• https://t.me/cveNotify/147827 · Telegram Post
• https://vuldb.com/?id.335857 · Note
• https://vuldb.com/?ctiid.335857 · Note
• https://twitter.com/CVEnew/status/1999144287422865848 · Twitter Post
• https://vuldb.com/?submit.702943 · Note