Which versions of xxl-sso are affected by CVE-2025-6700?

Organizations using A vulnerability classified as problematic should be aware of moderate risk from CVE-2025-6700, a cross-site scripting vulnerability rated CVSS 4.3.

Is there a public PoC exploit available for CVE-2025-6700?

Yes, a public proof-of-concept exploit is available for CVE-2025-6700. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6700?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

xxl-sso CVE-2025-6700

Q: What is the CVSS score of CVE-2025-6700?

CVE-2025-6700 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-19213 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-06-26 cna@vuldb.com

GHSA-2jfg-73q2-24qv

XSS Xxl Sso Xuxueli

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Reflected XSS with user interaction needed; only low integrity impact, no confidentiality or availability impact on vulnerable system.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

4.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 23:54 euvd

EUVD-2025-19213

Analysis Generated

Mar 15, 2026 - 23:54 vuln.today

PoC Detected

Sep 15, 2025 - 14:02 vuln.today

Public exploit code

CVE Published

Jun 26, 2025 - 16:15 cve.org

LOW 2.1

CVE Published

Jun 26, 2025 - 16:15 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability classified as problematic was found in Xuxueli xxl-sso 1.1.0. This vulnerability affects unknown code of the file /xxl-sso-server/login. The manipulation of the argument errorMsg leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Cross-site scripting in xuxueli xxl-sso 1.1.0 login page allows remote attackers to inject arbitrary web script via the errorMsg parameter. The vulnerability is publicly disclosed with exploit code available, but no active exploitation has been confirmed by CISA KEV. Successful exploitation could lead to session hijacking or defacement if an administrator or user interacts with a crafted link.

Technical ContextAI

xxl-sso is a lightweight single sign-on solution for Java web applications. The vulnerability is a classic reflected cross-site scripting (CWE-79) in the /xxl-sso-server/login endpoint. The errorMsg parameter value is reflected in the HTTP response without proper output encoding, allowing an attacker to supply a script that executes in the browser of the victim. The affected product is uniquely identified by CPE cpe:2.3:a:xuxueli:xxl-sso:1.1.0.

RemediationAI

No vendor-released patch identified; the vendor was contacted but did not respond. As an immediate workaround, apply output encoding to the errorMsg parameter in the server-side code to neutralize script injection. Alternatively, restrict access to the xxl-sso login endpoint to trusted networks, though this will prevent remote user authentication. Consider replacing the unmaintained xxl-sso component with an actively supported identity provider.