Which versions of WebStack-Guns are affected by CVE-2025-5887?

CVE-2025-5887 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 3.5).

Is there a public PoC exploit available for CVE-2025-5887?

Yes, a public proof-of-concept exploit is available for CVE-2025-5887. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-5887?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

WebStack-Guns CVE-2025-5887

Q: What is the CVSS score of CVE-2025-5887?

CVE-2025-5887 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-17559 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-06-09 cna@vuldb.com

XSS Java File Upload Webstack Guns Jsnjfz

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Requires low privileges and user interaction; scope changed due to XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.5 (LOW) 2.0 (LOW)

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17559

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

PoC Detected

Jul 10, 2025 - 16:19 vuln.today

Public exploit code

CVE Published

Jun 09, 2025 - 17:15 nvd

LOW 3.5

CVE Published

Jun 09, 2025 - 17:15 cve.org

LOW 2.0

DescriptionCVE.org

A vulnerability was found in jsnjfz WebStack-Guns 1.0. It has been classified as problematic. Affected is an unknown function of the file UserMgrController.java of the component File Upload. The manipulation of the argument File leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stored cross-site scripting in WebStack-Guns 1.0 allows authenticated users with file upload privileges to inject arbitrary JavaScript via the File parameter in UserMgrController.java. Public exploit code exists, but no active exploitation has been reported and EPSS risk is low (0.03%).

Technical ContextAI

The vulnerability is a stored XSS (CWE-79) in the Java-based WebStack-Guns application, specifically in the file upload functionality of UserMgrController.java. The CPE indicates version 1.0 is affected. Stored XSS occurs when user-supplied input is not properly sanitized before being stored and later rendered in a web page, allowing attackers to execute scripts in the context of other users' browsers.

RemediationAI

No vendor-released patch identified at time of analysis. As a workaround, restrict file upload functionality to trusted users only, implement strict input validation and output encoding for uploaded file names, and consider disabling the file upload feature if not essential. Monitor for any vendor updates.