What is the CVSS score of CVE-2025-50581?

CVE-2025-50581 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2025-50581?

Yes, a public proof-of-concept exploit is available for CVE-2025-50581. Prioritise patching immediately. EPSS: 0.2%.

MRCMS CVE-2025-50581

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-07-18 cve@mitre.org

XSS Mrcms

4.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

Admin authentication required (PR:H), victim interaction needed (UI:R), scope changes to other sessions (S:C); no availability impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:20 vuln.today

DescriptionCVE.org

MRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/group/save.do.

AnalysisAI

Stored cross-site scripting in MRCMS 3.1.2's admin group management endpoint allows an authenticated administrator to inject malicious JavaScript via /admin/group/save.do, which executes in the browser of any other admin who subsequently visits the affected page. The scope-changed CVSS vector (S:C) confirms the impact crosses the security boundary from the injecting session to other users' sessions. A publicly available proof-of-concept exists on GitHub, though EPSS sits at 0.22% (13th percentile), indicating limited observed exploitation activity at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: MRCMS 3.1.2 fails to sanitize or encode user-supplied input before rendering it in the HTML response of the /admin/group/save.do endpoint. The CPE string cpe:2.3:a:mrcms:mrcms:3.1.2:*:*:*:*:*:*:* pinpoints the exact affected release. The CVSS Scope:Changed metric indicates the vulnerability affects a security context beyond the originating session - classically the symptom of stored XSS where a persisted payload is later rendered to other authenticated users. MRCMS is a Java-based content management system hosted on Gitee (https://gitee.com/marker/MRCMS), suggesting a primarily Chinese-market audience and limited external security vetting.

RemediationAI

No vendor-released patched version has been identified at time of analysis; the NVD references point only to the project repository at https://gitee.com/marker/MRCMS and to the POC issue at https://github.com/SimonKang949/Vulnerabilities/issues/6, not to a tagged fix release. Operators should monitor the Gitee repository for a remediation commit or release. As a compensating control, restrict access to the /admin/group/save.do endpoint to the minimum necessary set of administrator accounts, reducing the pool of potential attackers who can inject payloads. Implementing a Content Security Policy (CSP) header that disallows inline scripts will limit the impact of any XSS payload that does execute, though this does not eliminate the underlying injection flaw. Enabling HTTP-only and Secure flags on session cookies limits the value of session-hijacking payloads. These controls reduce exploit impact but do not remediate the root-cause input validation deficiency.