Is there a public PoC exploit available for CVE-2025-15144?

Yes, a public proof-of-concept exploit is available for CVE-2025-15144. Prioritise patching immediately. EPSS: 0.0%.

XunRuiCMS CVE-2025-15144

Q: What is the CVSS score of CVE-2025-15144?

CVE-2025-15144 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-12-28 cna@vuldb.com

XSS PHP Xunruicms

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

User interaction required; only integrity impact; no confidentiality gain

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 16:07 vuln.today

CVE Published

Dec 28, 2025 - 17:16 cve.org

LOW 2.1

DescriptionCVE.org

A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. The impacted element is the function dr_show_error/dr_exit_msg of the file /dayrui/Fcms/Init.php of the component JSONP Callback Handler. This manipulation of the argument callback causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Cross-site scripting (XSS) in dayrui XunRuiCMS up to version 4.7.1 via the JSONP callback argument allows remote attackers to execute arbitrary JavaScript in the context of a victim's browser. Public exploit code is available, but the vulnerability requires user interaction and has low CVSS score (2.1) with minimal EPSS (0.05%), indicating limited real-world exploitation risk. No vendor patch exists; the vendor was unresponsive to disclosure.

Technical ContextAI

The vulnerability resides in the JSONP callback handler within the file /dayrui/Fcms/Init.php, specifically the functions dr_show_error and dr_exit_msg. The ‘callback’ argument is reflected without proper sanitization, enabling stored/reflected XSS (CWE-79). JSONP is a technique used to bypass same-origin policy by injecting a script tag; the attacker controls the callback function name. CPE data indicates all XunRuiCMS versions are affected, as no version-specific patched range is identified.

RemediationAI

No official patch has been released by the vendor (dayrui) as they did not respond to the disclosure. As a workaround, administrators should disable or restrict access to the JSONP callback feature if not needed, or implement input sanitization for the callback parameter via a custom middleware or web application firewall (WAF). Adding a rewrite rule to block requests containing script constructs in the callback parameter can mitigate exploitation. These workarounds may break legitimate JSONP functionality. Monitor for future vendor updates.