CVE-2025-8191
A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3.
Does this matter?
A public exploit is published in Exploit-DB, so the technical barrier is gone even though the severity is low and EPSS is 1.8%. Treat it as high on anything reachable from the internet.
Description
A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
- CVSS 4.0
- 2.0 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 1.79% probability · 78th percentile
- Public exploits
- 1 in Exploit-DB · first 3 August 2025
- CISA KEV
- Not listed
- Weakness
- CWE-79, CWE-94
- Affected
- macrozheng/mall
- Source
- cna@vuldb.com
EPSS 1.8% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
Public exploits (1)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
References
- https://github.com/macrozheng/mall/issues/919Broken Link
- https://github.com/zast-ai/vulnerability-reports/blob/main/mall/DOM_XSS.mdExploit, Third Party Advisory
- https://vuldb.com/?ctiid.317604Permissions Required, VDB Entry
- https://vuldb.com/?id.317604Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.615731Third Party Advisory, VDB Entry
- https://github.com/zast-ai/vulnerability-reports/blob/main/mall/DOM_XSS.mdExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.