Which versions of spring-analysis are affected by CVE-2025-6509?

CVE-2025-6509 is a low-severity vulnerability in seaswalker spring-analysis involving cross-site scripting (CVSS 3.5).

Is there a public PoC exploit available for CVE-2025-6509?

Yes, a public proof-of-concept exploit is available for CVE-2025-6509. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-6509?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

spring-analysis CVE-2025-6509

Q: What is the CVSS score of CVE-2025-6509?

CVE-2025-6509 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-18896 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-06-23 cna@vuldb.com

XSS Java

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Requires low privileges and user interaction; scope changed due to XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.5 (LOW) 2.0 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 22:10 euvd

EUVD-2025-18896

Analysis Generated

Mar 15, 2026 - 22:10 vuln.today

PoC Detected

Jun 23, 2025 - 20:16 vuln.today

Public exploit code

CVE Published

Jun 23, 2025 - 16:15 cve.org

LOW 2.0

CVE Published

Jun 23, 2025 - 16:15 nvd

LOW 3.5

DescriptionCVE.org

A vulnerability was found in seaswalker spring-analysis up to 4379cce848af96997a9d7ef91d594aa129be8d71. It has been declared as problematic. Affected by this vulnerability is the function echo of the file /src/main/java/controller/SimpleController.java. The manipulation of the argument Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

AnalysisAI

Cross-site scripting (XSS) in seaswalker spring-analysis up to commit 4379cce allows remote authenticated users to inject arbitrary web scripts via the Name parameter in SimpleController.java. A public exploit exists, but EPSS score is low (0.05%) and no active exploitation has been reported.

Technical ContextAI

The vulnerability is a stored XSS (CWE-79) in a Java Spring-based analysis tool. The affected file is /src/main/java/controller/SimpleController.java, where the echo function reflects user input without sanitization. The product uses rolling releases, so version details are not available; the affected commit is 4379cce848af96997a9d7ef91d594aa129be8d71.

RemediationAI

No official patch version is available due to rolling release model. Users should update to the latest commit beyond 4379cce. As a workaround, sanitize the Name parameter in SimpleController.java or apply input validation. Monitor the GitHub repository for fixes.