प्लेटफ़ॉर्म
php
में ठीक किया गया
6.0.1
6.1.1
6.2.1
6.3.1
6.4.1
CVE-2025-15416 describes a cross-site scripting (XSS) vulnerability discovered in wangmarket versions 6.0 through 6.4. This flaw resides within the /siteVar/save.do endpoint, allowing attackers to inject malicious scripts through manipulation of the Remark/Variable Value argument. The vulnerability is rated as LOW severity and a public exploit is available, highlighting the potential for immediate exploitation.
Successful exploitation of CVE-2025-15416 allows an attacker to inject arbitrary JavaScript code into the web application. This can lead to various malicious outcomes, including session hijacking, defacement of the website, and redirection of users to phishing sites. The attacker could potentially steal sensitive user data, such as login credentials or personal information. Given the public availability of an exploit, the risk of exploitation is elevated, particularly for systems with unpatched instances of wangmarket.
This vulnerability has been publicly disclosed and a proof-of-concept exploit is available, indicating a high probability of exploitation. The CVE was published on 2026-01-01. The vendor, wangmarket, has not responded to early disclosure attempts, which may delay the release of a patch. The CVSS score is 2.4 (LOW), reflecting the potential for exploitation but also the limited impact of a successful attack.
Organizations utilizing wangmarket versions 6.0 through 6.4 are at risk, particularly those with publicly accessible instances of the application. Shared hosting environments where multiple users share the same server instance are also at increased risk, as a compromise of one user's account could potentially lead to the exploitation of this vulnerability across multiple websites.
• php / web:
grep -r 'Remark/Variable Value' /var/www/wangmarket/siteVar/save.do• generic web:
curl -I http://your-wangmarket-site.com/siteVar/save.do?Remark/Variable%20Value=<script>alert(1)</script>• generic web: Examine access logs for requests to /siteVar/save.do containing suspicious characters or script tags in the Remark/Variable Value parameter.
• generic web: Check response headers for signs of XSS, such as Content-Security-Policy directives that are not properly configured.
disclosure
एक्सप्लॉइट स्थिति
EPSS
0.03% (10% शतमक)
CISA SSVC
CVSS वेक्टर
The primary mitigation for CVE-2025-15416 is to upgrade to a patched version of wangmarket. Since a fixed version is not specified, immediate action is crucial. As a temporary workaround, implement strict input validation on the Remark/Variable Value parameter within the /siteVar/save.do endpoint. This should include sanitizing user input to prevent the injection of malicious scripts. Additionally, configure a Web Application Firewall (WAF) to detect and block XSS attempts targeting this endpoint. Regularly review access logs for suspicious activity.
wangmarket को 6.4 से बाद के संस्करण में अपडेट करें। यदि अपडेट करना संभव नहीं है, तो दुर्भावनापूर्ण कोड इंजेक्शन से बचने के लिए Remark और Variable Value फ़ील्ड के इनपुट की समीक्षा और फ़िल्टर करें।
भेद्यता विश्लेषण और गंभीर अलर्ट सीधे आपके ईमेल में।
CVE-2025-15416 is a cross-site scripting (XSS) vulnerability affecting wangmarket versions 6.0 through 6.4, allowing attackers to inject malicious scripts via the /siteVar/save.do endpoint.
You are affected if you are running wangmarket versions 6.0, 6.1, 6.2, 6.3, or 6.4 and have not applied a patch or implemented mitigating controls.
Upgrade to a patched version of wangmarket as soon as it becomes available. Until then, implement input validation and WAF rules to protect the /siteVar/save.do endpoint.
Yes, a public exploit exists, indicating a high probability of active exploitation. Prompt action is recommended.
Due to lack of vendor response, an official advisory may not be available. Monitor security news sources and community forums for updates.
अपनी डिपेंडेंसी फ़ाइल अपलोड करें और तुरंत जानें कि यह CVE और अन्य आपको प्रभावित करती हैं या नहीं।