Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the variableList function of the /admin/system/variableList.do endpoint when handling the Description argument. An attacker can inject and execute arbitrary scripts in the context of a user's browser by...

CVE-2025-15452 xnx3 wangmarket Backend Variable Search variableList.do variableList cross site scripting

A weakness has been identified in xnx3 wangmarket up to 4.9. This affects the function variableList of the file /admin/system/variableList.do of the component Backend Variable Search. Executing a manipulation of the argument Description can lead to cross site scripting. The attack may be launched...

CVE-2025-15452

CVE-2025-15452 affects xnx3 wangmarket up to version 4.9, targeting the Backend Variable Search component: the function variableList.do’s Description parameter can be manipulated to trigger Cross-Site Scripting (XSS). The issue is exploitable remotely, with public PoCs available. Multiple sources...

CVE-2025-15452 xnx3 wangmarket Backend Variable Search variableList.do variableList cross site scripting

A weakness has been identified in xnx3 wangmarket up to 4.9. This affects the function variableList of the file /admin/system/variableList.do of the component Backend Variable Search. Executing a manipulation of the argument Description can lead to cross site scripting. The attack may be launched...

CVE-2025-15452: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in xnx3 wangmarket up to 4.9. This affects the function variableList of the file /admin/system/variableList.do of the component Backend Variable Search. Executing a manipulation of the argument Description can lead to cross site scripting. The attack may be launched...