CVE-2025-15451

LOW

wangmarket < 4.9 - Cross-Site Scripting via System Variables Page Description Parameter

Title source: llm
STIX 2.1

Description

A security flaw has been discovered in xnx3 wangmarket up to 4.9. Affected by this issue is some unknown functionality of the file /admin/system/variableSave.do of the component System Variables Page. Performing a manipulation of the argument Description results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.339484
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.339484
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.724838

Scores

CVSS v3 2.4
EPSS 0.0024
EPSS Percentile 14.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (1)
wang.market/wangmarket < 4.9
Published Jan 05, 2026
Tracked Since Feb 18, 2026