CVE-2025-2709

MEDIUMNuclei

Yonyou UFIDA ERP-NC login.jsp cross site scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-2709 has a selected CVSS score of 5.3 (medium); EIP currently links 1 Nuclei template.

Description

A vulnerability has been found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This vulnerability affects unknown code of the file /login.jsp. The manipulation of the argument key/redirect leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 25, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

UFIDA ERP-NC

Browse Yonyou / UFIDA ERP-NC
CVE List5.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMYonyou UFIDA ERP-NC V5.0 - Cross-Site ScriptingCVSS 6.1

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the key and redirect parameters in login.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.

Impact

Attackers can inject malicious JavaScript through multiple parameters in login.jsp, potentially stealing user credentials, session cookies, or redirecting users to malicious sites.

Remediation

Upgrade to Yonyou UFIDA ERP-NC version 5.1 or later that properly sanitizes user input.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2025xsserp-ncufidayonyouvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:yonyou:ufida_erp-nc:5.0:*:*:*:*:*:*:*
FOFA: icon_hash="1085941792"
https://github.com/Hebing123/cve/issues/84 https://nvd.nist.gov/vuln/detail/CVE-2025-2709

Source: ProjectDiscovery

References

5