CVE-2025-6551
java-aodeng Hope-Boot WebController.java login cross site scripting
- State
- Published
- Severity
- 5.1 Medium
- Published
- Jun 24, 2025
- Updated
- Jun 24, 2025
- Reserved
- Jun 23, 2025
Description
A vulnerability was found in java-aodeng Hope-Boot 1.0.0 and classified as problematic. This issue affects the function Login of the file /src/main/java/com/hope/controller/WebController.java. The manipulation of the argument errorMsg leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 3.5 Low | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 3.0 | 3.5 Low | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Hope-Bootjava-aodeng |
|
References
- VDB-313691 | java-aodeng Hope-Boot WebController.java login cross site scriptingvdb-entrytechnical-description
- VDB-313691 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #596615 | java-aodeng hope-boot 1.0.0-release Cross Site Scriptingthird-party-advisory
- https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-01/report.mdexploit
- https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-01/report.md#steps-to-reproduceexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.