CVE-2025-8191: macrozheng mall Swagger UI index.html cross site scripting
A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8191?
CVE-2025-8191 is classified as problematic due to its potential for cross site scripting exploitation.
How do I fix CVE-2025-8191?
To fix CVE-2025-8191, ensure you upgrade the macrozheng mall to a version above 1.0.3 and correctly validate any input that could lead to cross site scripting.
What components are affected by CVE-2025-8191?
CVE-2025-8191 affects the Swagger UI component located in the /swagger-ui/index.html file of the macrozheng mall.
What type of attack does CVE-2025-8191 enable?
CVE-2025-8191 enables cross site scripting attacks by manipulating the configUrl argument.
Is there any workaround for CVE-2025-8191?
As of now, there are no known workarounds for CVE-2025-8191 other than upgrading the software to a secure version.