CVE-2025-15372
youlaitech vue3-element-admin Notice index.vue cross site scripting
- State
- Published
- Severity
- 4.8 Medium
- Published
- Dec 31, 2025
- Updated
- Jan 2, 2026
- Reserved
- Dec 30, 2025
Description
A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/views/system/notice/index.vue of the component Notice Handler. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 2.4 Low | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 2.4 Low | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 3.3 Low | AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
vue3-element-adminyoulaitech |
|
References
- VDB-339080 | youlaitech vue3-element-admin Notice index.vue cross site scriptingvdb-entry
- VDB-339080 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #718345 | youlaitech vue3-element-admin <=v3.4.0 XSSthird-party-advisory
- https://github.com/AnalogyC0de/public_exp/blob/main/archives/vue3-element-admin/report.mdrelated
- https://github.com/AnalogyC0de/public_exp/blob/main/archives/vue3-element-admin/report.md#proof-of-conceptexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.