CVE-2025-8191

🗓️ 26 Jul 2025 13:32:05Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 40 Views🌐 WEB

Vulnerability CVE-2025-8191 in macrozheng mall allows cross site scripting via Swagger UI configUrl manipulation

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-8191	28 Jul 202509:00	–	circl
CNNVD	mall 代码注入漏洞	26 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-8191 macrozheng mall Swagger UI index.html cross site scripting	26 Jul 202513:32	–	cvelist
Exploit DB	Swagger UI 1.0.3 - Cross-Site Scripting (XSS)	3 Aug 202500:00	–	exploitdb
EUVD	EUVD-2025-22797	3 Oct 202520:07	–	euvd
GithubExploit	Exploit for CVE-2025-8191	28 Jul 202503:09	–	githubexploit
NVD	CVE-2025-8191	26 Jul 202514:15	–	nvd
Packet Storm News	Swagger UI 1.0.3 Cross Site Scripting	4 Aug 202500:00	–	packetstormnews
Positive Technologies	PT-2025-30978	26 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-8191	28 Jul 202514:21	–	redhatcve

NVD

Vulners

Node

macrozheng mallRange≤1.0.3

[
  {
    "vendor": "macrozheng",
    "product": "mall",
    "versions": [
      {
        "version": "1.0.0",
        "status": "affected"
      },
      {
        "version": "1.0.1",
        "status": "affected"
      },
      {
        "version": "1.0.2",
        "status": "affected"
      },
      {
        "version": "1.0.3",
        "status": "affected"
      }
    ],
    "modules": [
      "Swagger UI"
    ]
  }
]

Source	Link
github	www.github.com/zast-ai/vulnerability-reports/blob/main/mall/DOM_XSS.md
vuldb	www.vuldb.com/
github	www.github.com/macrozheng/mall/issues/919
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
configUrl	query param	swagger-ui/index.html	Swagger UI vulnerable via configUrl parameter enabling XSS/remoteScript execution (CVE-2025-8191).	CWE-79, CWE-94

29 Apr 2026 01:00Current

3.7Low risk

Vulners AI Score3.7

CVSS 3.13.5 - 5.4

CVSS 24

CVSS 45.1

CVSS 33.5

EPSS0.00678

SSVC