CVE-2025-28399: Critical severity xmall vulnerability
Published Apr 15, 2025
·Updated
An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class.
Affected Software
2 affected components
Exrick XMall=1.1
Erick xmall<1.1
Event History
Apr 15, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-28399?
CVE-2025-28399 has a medium severity rating due to its ability to allow privilege escalation.
2
How do I fix CVE-2025-28399?
To fix CVE-2025-28399, update Erick xmall to version 1.2 or later.
3
What versions of Erick xmall are affected by CVE-2025-28399?
CVE-2025-28399 affects Erick xmall versions 1.1 and earlier.
4
Can CVE-2025-28399 be exploited remotely?
Yes, CVE-2025-28399 can be exploited remotely through the updateAddress method.
5
What component of Erick xmall is involved in CVE-2025-28399?
The issue in CVE-2025-28399 involves the Address Controller class in Erick xmall.