CVE-2025-8191

macrozheng mall Swagger UI index.html cross site scripting

State: Published
Severity: 5.1 Medium
Published: Jul 26, 2025
Updated: Jul 28, 2025
Reserved: Jul 25, 2025

Description

A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R	VulDB
3.0	3.5 Low	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
mallmacrozheng	1.0.0Affected 1.0.1Affected 1.0.2Affected 1.0.3Affected

References

VDB-317604 | macrozheng mall Swagger UI index.html cross site scriptingvdb-entrytechnical-description
VDB-317604 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #615731 | mall <=1.0.3 DOM XSSthird-party-advisory
https://github.com/zast-ai/vulnerability-reports/blob/main/mall/DOM_XSS.mdexploit
https://github.com/macrozheng/mall/issues/919issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.