CVE-2025-5135

Tmall Demo Product Details Page admin cross site scripting

State: Published
Severity: 4.8 Medium
Published: May 24, 2025
Updated: May 28, 2025
Reserved: May 23, 2025

Description

A vulnerability, which was classified as problematic, has been found in Tmall Demo up to 20250505. Affected by this issue is some unknown functionality of the file /tmall/admin/ of the component Product Details Page. The manipulation of the argument Product Name/Product Title leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	VulDB
3.1	2.4 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N	VulDB
3.0	2.4 Low	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N	VulDB
2.0	3.3 Low	AV:N/AC:L/Au:M/C:N/I:P/A:N	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
DemoTmall	20250505Affected

References

VDB-310214 | Tmall Demo Product Details Page admin cross site scriptingvdb-entrytechnical-description
VDB-310214 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #571941 | project_team Tmall_demo 2025/05/05 latest Stored Cross-Site Scriptingthird-party-advisory
https://github.com/bdkuzma/vuln/issues/14exploitissue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.