yourmaileyes MOOC Submission MainController.java subreview cross site scripting

The XSS vulnerability in yourmaileyes MOOC allows an attacker to inject arbitrary JavaScript code into the application. This code can then be executed in the context of a user's browser when they visit a vulnerable page. Attackers could leverage this to steal session cookies, redirect users to phishing sites, or deface the application. The remote nature of the exploit means attackers don't need local access to the server. Given the public availability of a proof-of-concept, the risk of exploitation is elevated, particularly for systems running unpatched versions of yourmaileyes MOOC.

Organizations using yourmaileyes MOOC for online learning platforms, particularly those running versions 1.0 through 1.17, are at risk. Shared hosting environments where multiple users share the same server instance are also at increased risk, as a successful exploit could potentially impact other users on the same server.

• java / server:

find /var/www/yourmaileyes/mooc/controller/ -name MainController.java -print

• java / server:

grep -r 'subreview' /var/www/yourmaileyes/mooc/controller/

• generic web: Check for unusual JavaScript code being injected into pages via URL parameters. Use browser developer tools to inspect network requests and responses for suspicious scripts. • generic web: Review access logs for requests containing unusual characters or patterns in the review parameter.

1. 2025-12-28Disclosure

   disclosure

2. 2025-12-28PoC

   poc

3. 2025-12-28Patch

   patch

1. आरक्षित2025-12-27
2. प्रकाशित2025-12-28
3. संशोधित2025-12-29
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-15134 is to upgrade your installation of yourmaileyes MOOC to version 1.17.1 or later. If upgrading immediately is not feasible, consider implementing input validation and output encoding on the review parameter within the MainController.java file. While not a complete solution, this can reduce the attack surface. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide an additional layer of defense. Monitor your application logs for suspicious activity, particularly requests containing unusual characters or patterns in the review parameter.