CVE-2025-8223 jerryshensjf JPACookieShop 蛋糕商城JPA版 AdminTypeCustController.java cross-site request forgery

Medium 5.3 Published 27 Jul 2025 Updated 28 Jul 2025

Attackers can perform unauthorized actions on behalf of authenticated users in the JPACookieShop web application via cross-site request forgery.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-8223?

CVE-2025-8223 is a medium-severity vulnerability in jerryshensjf JPACookieShop 蛋糕商城JPA版, published on 27 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A vulnerability, which was classified as problematic, was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. This affects an unknown part of the file AdminTypeCustController.java. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

Weakness: CWE-862, CWE-352

Which versions are affected by CVE-2025-8223?

It affects 1 product.

Products include Jerryshensjf Jpacookieshop.

How do I fix CVE-2025-8223?

No fix has been published for CVE-2025-8223 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-8223 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-8223 exists.

Sources

Also known as GHSA-m8wg-q6g6-mm6h.