Is there a public PoC exploit available for CVE-2025-14801?

Yes, a public proof-of-concept exploit is available for CVE-2025-14801. Prioritise patching immediately. EPSS: 0.1%.

xiweicheng TMS CVE-2025-14801

Q: What is the CVSS score of CVE-2025-14801?

CVE-2025-14801 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-12-17 cna@vuldb.com

XSS Teamwork Management System

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:38 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in xiweicheng TMS up to 2.28.0. This affects the function createComment of the file /admin/blog/comment/create. Such manipulation of the argument content leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Reflected cross-site scripting (XSS) in xiweicheng Teamwork Management System up to version 2.28.0 allows high-privilege users to inject malicious scripts via the content parameter in the /admin/blog/comment/create endpoint. The vulnerability requires admin authentication and user interaction (UI:P), limiting real-world risk despite network accessibility. Publicly available exploit code exists, though EPSS scoring (0.06%, 18th percentile) and CVSS 1.9 indicate low actual exploitation probability due to high privilege requirements.

Technical ContextAI

The vulnerability stems from improper input validation and output encoding in the comment creation functionality of xiweicheng's Teamwork Management System. The createComment function at /admin/blog/comment/create fails to sanitize the content parameter before rendering it in responses, enabling stored or reflected XSS attacks (CWE-79: Improper Neutralization of Input During Web Page Generation). The affected product is identified by CPE cpe:2.3:a:xiweicheng:teamwork_management_system (all versions through 2.28.0). The attack vector is network-based (AV:N), but exploitation requires PR:H (high privilege level, typically admin role) and UI:P (user interaction such as clicking a link), which significantly constrains practical attack scenarios.

RemediationAI

Upgrade xiweicheng TMS to a version later than 2.28.0 if available from the vendor; however, no patched version has been independently confirmed as the vendor did not respond to early disclosure. As a compensating control, restrict access to the /admin/blog/comment/create endpoint using web application firewall (WAF) rules to only trusted IP ranges or require additional authentication factors beyond standard admin credentials. Implement content security policy (CSP) headers with strict script-src directives to mitigate XSS payload execution. Sanitize all user-supplied input in the content parameter using a vetted HTML sanitization library (e.g., DOMPurify, OWASP Encoder) before storage and output encoding before rendering. Monitor admin account activity for anomalous comment creation patterns. If upgrade is not feasible, disable the blog comment functionality entirely until a fix is available.

CVE-2025-14801 vulnerability details – vuln.today

Back