CVE-2025-65540 Details
Description
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields such as username and description are directly rendered into HTML without proper sanitization or encoding, allowing attackers to inject and execute malicious scripts.
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in xmall version 1.1. These vulnerabilities arise from improper handling of user-supplied data, particularly in fields such as username and description, which are rendered into HTML without adequate sanitization or encoding. This oversight allows attackers to inject and execute malicious scripts.
To address this vulnerability, implement strict input validation on the server-side for all user-supplied fields. Apply context-appropriate output encoding for all user data displayed in HTML. Replace direct HTML injections with text-only alternatives, and consider implementing a Content Security Policy to mitigate XSS impacts.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 1, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Exrick/xmall/issues/101 | [email protected] | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| exrick xmall | 1.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 23, 2025 | Initial Analysis | [email protected] |
| Dec 1, 2025 | CVE Modified | CISA-ADP |
| Nov 29, 2025 | New CVE Received | [email protected] |