CVE-2025-15149: XSS in rawchen ecms

An attacker can exploit this XSS vulnerability by manipulating the 'productName' argument in the updateProductServlet function. This allows them to inject arbitrary JavaScript code that will be executed in the context of the user's browser. Successful exploitation could result in the attacker stealing session cookies, redirecting users to malicious websites, or defacing the application. The impact is amplified if the application is used by privileged users, as the attacker could potentially gain access to sensitive data or perform administrative actions. Because the vulnerability is publicly disclosed, the risk of exploitation is elevated.

1. Reserved2025-12-27
2. Published2025-12-28
3. Modified2025-12-29
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-15149 is to upgrade to rawchen ecms version 59.0.1 or later. Given the rolling release nature of the product, ensuring all instances are updated is critical. As a temporary workaround, input validation on the 'productName' field can be implemented to sanitize user-supplied data and prevent the injection of malicious scripts. This could involve restricting the allowed characters or escaping special characters. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide an additional layer of protection. Monitor application logs for suspicious activity, particularly related to the updateProductServlet endpoint.