What is the CVSS score of EUVD-2025-201108?

EUVD-2025-201108 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Eyoucms are affected by EUVD-2025-201108?

An unpatched XML injection vulnerability in eyoucms v1.7.1 allows attackers to disrupt service availability with crafted requests.

Is there a public PoC exploit available for EUVD-2025-201108?

Yes, a public proof-of-concept exploit is available for EUVD-2025-201108. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2025-201108?

Within 24 hours: Inventory all systems running eyoucms v1.7.1 and restrict network access to administration interfaces. Within 7 days: Deploy Web Application Firewall rules to block malicious XML payloads and POST requests containing XXE patterns; consider disabling XML parsing in eyoucms if not operationally critical. Within 30 days: Migrate to an alternative CMS or prepare for immediate deployment of vendor patches once available; establish monitoring for exploitation attempts.

Eyoucms EUVD-2025-201108

| CVE-2025-65868 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2025-12-03 cve@mitre.org

XXE Denial Of Service Eyoucms

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 16:14 euvd

EUVD-2025-201108

Analysis Generated

Mar 15, 2026 - 16:14 vuln.today

PoC Detected

Dec 16, 2025 - 19:13 vuln.today

Public exploit code

CVE Published

Dec 03, 2025 - 21:15 nvd

HIGH 7.5

DescriptionCVE.org

XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST request.

Analysis

XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST request.

Technical ContextAI

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Improper Restriction of XML External Entity Reference (CWE-611).