CVE-2025-9095

LOW

ExpressGateway express-gateway <= 1.16.10 - Cross-Site Scripting in REST Endpoint

Title source: llm
STIX 2.1

Description

A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of the component REST Endpoint. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5
Core References
Permissions Required, VDB Entry vdb-entry
https://vuldb.com/?id.320417
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.320417
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.627709

Scores

CVSS v3 3.5
EPSS 0.0005
EPSS Percentile 17.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (12)
ExpressGateway/express-gateway 1.16.0
ExpressGateway/express-gateway 1.16.1
ExpressGateway/express-gateway 1.16.10
ExpressGateway/express-gateway 1.16.2
ExpressGateway/express-gateway 1.16.3
ExpressGateway/express-gateway 1.16.4
ExpressGateway/express-gateway 1.16.5
ExpressGateway/express-gateway 1.16.6
ExpressGateway/express-gateway 1.16.7
ExpressGateway/express-gateway 1.16.8
... and 2 more
Published Aug 17, 2025
Tracked Since Feb 18, 2026