rawchen ecms CVE-2025-15149

Q: What is the CVSS score of CVE-2025-15149?

CVE-2025-15149 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-12-28 cna@vuldb.com

XSS Java

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

High privileges required to inject payload; scope changes because stored payload executes in other users' browsers; low C/I reflects typical XSS session-theft impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 16:06 vuln.today

DescriptionCVE.org

A vulnerability has been found in rawchen ecms up to b59d7feaa9094234e8aa6c8c6b290621ca575ded. Affected by this vulnerability is the function updateProductServlet of the file src/servlet/product/updateProductServlet.java of the component Add New Product Page. The manipulation of the argument productName leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stored cross-site scripting in rawchen ecms allows a high-privileged authenticated attacker to inject persistent JavaScript payloads via the productName parameter on the Add New Product page, which subsequently executes in the browsers of users who view the affected product listings. The vulnerable component is updateProductServlet.java, and the flaw stems from unsanitized input being stored and later rendered without encoding. A public proof-of-concept has been disclosed via GitHub; the vendor has not responded to the disclosure, and no patch is available.

Technical ContextAI

rawchen ecms is an open-source Java servlet-based e-commerce content management system hosted on GitHub (rolling release, no versioned releases). The vulnerable endpoint is the servlet class updateProductServlet in src/servlet/product/updateProductServlet.java, which processes form submissions from the Add New Product administrative page. The productName parameter is accepted, persisted to the backing data store, and later rendered into HTML responses without proper output encoding or input sanitization, constituting a stored (persistent) XSS flaw under CWE-79 (Improper Neutralization of Input During Web Page Generation). Because the payload survives in the datastore and is served to multiple downstream users, the impact scope extends beyond the attacker to any authenticated or unauthenticated visitor who loads a page rendering the product name.

Affected ProductsAI

rawchen ecms up to and including commit b59d7feaa9094234e8aa6c8c6b290621ca575ded is confirmed affected. The project follows a rolling release model, so no discrete version numbers are available. Affected component is src/servlet/product/updateProductServlet.java. No CPE string was provided. The vendor has not issued an advisory. Details are available via VulDB entry 338526 at https://vuldb.com/?id.338526 and the public PoC at https://github.com/zyhzheng500-maker/cve/blob/main/%E5%AD%98%E5%82%A8%E5%9E%8BXss.md.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to the responsible disclosure. The upstream fix is not confirmed in any tagged release. Immediate mitigations include: (1) implementing server-side output encoding for all user-supplied string fields rendered in HTML, specifically productName in updateProductServlet.java, using a library such as OWASP Java Encoder or applying HtmlUtils.htmlEscape() before persistence or rendering; (2) restricting access to the Add New Product page to the minimum necessary administrative accounts via network-layer ACL or application-level role enforcement, reducing the attacker pool; (3) deploying a Content Security Policy (CSP) header disallowing inline script execution as a defence-in-depth control. Note that CSP alone does not eliminate stored XSS but significantly raises the exploitation bar. Organisations running this software should monitor the project repository at https://github.com/rawchen/ecms for any upstream commit addressing input sanitization.