8.1

CVE-2025-4839

Exploit

itwanger paicoding CrossUtil.java cross-domain policy

A vulnerability has been found in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /paicoding-core/src/main/java/com/github/paicoding/forum/core/util/CrossUtil.java. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Itwanger ≫ Paicoding Version1.0.0
Itwanger ≫ Paicoding Version1.0.1
Itwanger ≫ Paicoding Version1.0.2
Itwanger ≫ Paicoding Version1.0.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.213
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
cna@vuldb.com 2.3 0 0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cna@vuldb.com 3.1 1.6 1.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
cna@vuldb.com 2.6 4.9 2.9
AV:N/AC:H/Au:N/C:N/I:P/A:N
CWE-346 Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains

The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

https://vuldb.com/?id.309307
Third Party Advisory
VDB Entry
https://vuldb.com/?ctiid.309307
VDB Entry
Permissions Required
https://vuldb.com/?submit.574826
Third Party Advisory
VDB Entry
https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250510-02.md
Exploit