CVE-2025-65540

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-11-29 · updated 2026-06-17
Weakness: CWE-79

Description

Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields such as username and description are directly rendered into HTML without proper sanitization or encoding, allowing attackers to inject and execute malicious scripts.

Affected products

Exrick xmall: 1.1

References

https://github.com/Exrick/xmall/issues/101

Get alerted when CVE-2025-65540 or the next vulnerability affects your stack