CVE-2025-8191 macrozheng mall Swagger UI index.html cross site scripting
Remote attackers can execute arbitrary scripts via the Swagger UI configUrl parameter in macrozheng mall, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-8191?
CVE-2025-8191 is a medium-severity cross-site scripting vulnerability in macrozheng mall, published on 26 Jul 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
Which versions are affected by CVE-2025-8191?
It affects 1 product.
Products include Macrozheng Mall.
How do I fix CVE-2025-8191?
No fix has been published for CVE-2025-8191 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-8191 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-8191 exists.
Public exploit code: 1 Exploit-DB entry and 4 proofs of concept on GitHub.
Other vulnerabilities in macrozheng mall
- CVE-2026-25858 macrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP Disclosure
- CVE-2025-8755 macrozheng mall com.macro.mall.portal.controller UmsMemberController.java detail authorization
- CVE-2025-9514 macrozheng mall Registration weak password
- CVE-2025-8741 macrozheng mall login cleartext transmission
- CVE-2025-8742 macrozheng mall Admin Login excessive authentication
Sources
Also known as GHSA-cw4g-wcrm-x4x7.