baowzh hfly CVE-2025-14519

No vendor-released patch has been identified at time of analysis, as baowzh did not respond to early disclosure. Organizations using hfly should immediately upgrade to the latest available commit from the official repository if a fix has been released post-disclosure; check the project's Git history for commits after 638ff9abe9078bc977c132b37acbe1900b63491c addressing XSS in the advtext module. As interim compensating controls, disable or restrict access to the /admin/index.php/advtext/add endpoint via web application firewall (WAF) rules or network access controls, limit advtext module access to highly trusted administrators only, and implement input validation and HTML entity encoding for all advtext submissions to prevent script injection. Additionally, deploy a WAF with XSS detection signatures to filter malicious payloads in POST/GET requests to the advtext add handler. Monitor application logs for suspicious submissions containing script tags or JavaScript event handlers. These mitigations reduce exposure but do not fully resolve the vulnerability without a vendor patch.