baowzh hfly
CVE-2025-14519
LOW
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. This issue affects some unknown processing of the file /admin/index.php/advtext/add of the component advtext Module. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be exploited. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stored cross-site scripting (XSS) in baowzh hfly up to commit 638ff9abe9078bc977c132b37acbe1900b63491c allows authenticated users with user interaction to inject malicious scripts via the /admin/index.php/advtext/add endpoint in the advtext module. Public exploit code is available, and the vulnerability carries a low CVSS score of 2.0 due to authentication and user-interaction requirements, but the EPSS score of 0.05% indicates minimal real-world exploitation probability despite public availability of proof-of-concept code.
Technical ContextAI
The vulnerability exists in the advtext module's add functionality, specifically in the /admin/index.php/advtext/add file processing. This is a stored XSS vulnerability (CWE-79) in a PHP-based travel website CMS, indicating that user-supplied input is not properly sanitized before being stored in the database or reflected in subsequent responses. The attack leverages the web application's failure to validate and encode untrusted data in the advtext add feature, allowing malicious JavaScript to be persisted and executed in the browsers of other users or administrators who view the affected content. The CPE designation (cpe:2.3:a:baowzh:hfly:*:*:*:*:*:*:*:*) indicates all versions of hfly are potentially affected, though the specific commit hash suggests the vulnerability existed at least up to version 638ff9abe9078bc977c132b37acbe1900b63491c.
RemediationAI
No vendor-released patch has been identified at time of analysis, as baowzh did not respond to early disclosure. Organizations using hfly should immediately upgrade to the latest available commit from the official repository if a fix has been released post-disclosure; check the project's Git history for commits after 638ff9abe9078bc977c132b37acbe1900b63491c addressing XSS in the advtext module. As interim compensating controls, disable or restrict access to the /admin/index.php/advtext/add endpoint via web application firewall (WAF) rules or network access controls, limit advtext module access to highly trusted administrators only, and implement input validation and HTML entity encoding for all advtext submissions to prevent script injection. Additionally, deploy a WAF with XSS detection signatures to filter malicious payloads in POST/GET requests to the advtext add handler. Monitor application logs for suspicious submissions containing script tags or JavaScript event handlers. These mitigations reduce exposure but do not fully resolve the vulnerability without a vendor patch.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today