CVE-2025-6700: Xuxueli xxl-sso login cross site scripting

Published Jun 26, 2025

Updated

A vulnerability classified as problematic was found in Xuxueli xxl-sso 1.1.0. This vulnerability affects unknown code of the file /xxl-sso-server/login. The manipulation of the argument errorMsg leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Xuxueli xxl-sso

Xuxueli xxl-sso=1.1.0

Event History

Jun 26, 2025

CVE Published

via MITRE·03:31 PM

Data Sourced

via MITRE·03:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Jun 14, 58473

Event

via NVD·05:13 PM

Frequently Asked Questions

What is the severity of CVE-2025-6700?

CVE-2025-6700 is classified as a problematic vulnerability affecting Xuxueli xxl-sso 1.1.0.

How does CVE-2025-6700 affect web applications?

CVE-2025-6700 allows for cross site scripting attacks through manipulation of the errorMsg argument in the login file.

Can CVE-2025-6700 be exploited remotely?

Yes, CVE-2025-6700 can be exploited remotely, posing a significant risk to affected systems.

What is the affected software for CVE-2025-6700?

CVE-2025-6700 affects the Xuxueli xxl-sso software, version 1.1.0.

How can I mitigate CVE-2025-6700?

To mitigate CVE-2025-6700, ensure proper input validation and sanitization of user inputs in the affected application.