CVE-2025-2491
Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting
- State
- Published
- Severity
- 4.8 Medium
- Published
- Mar 18, 2025
- Updated
- Mar 18, 2025
- Reserved
- Mar 18, 2025
Description
A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component Edit Template File Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 2.4 Low | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N | VulDB |
| 3.0 | 2.4 Low | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N | VulDB |
| 2.0 | 3.3 Low | AV:N/AC:L/Au:M/C:N/I:P/A:N | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ujcmsDromara |
|
References
- VDB-299997 | Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scriptingvdb-entrytechnical-description
- VDB-299997 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #517269 | ujcms v9.7.5 stored XSSthird-party-advisory
- https://github.com/dromara/ujcms/issues/14exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.