{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-9433","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2025-08-25T09:40:46.976Z","datePublished":"2025-08-26T01:02:12.291Z","dateUpdated":"2025-08-26T20:25:03.194Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2025-08-26T01:02:12.291Z"},"title":"mtons mblog Admin Panel list cross site scripting","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-79","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"type":"CWE","cweId":"CWE-94","lang":"en","description":"Code Injection"}]}],"affected":[{"vendor":"mtons","product":"mblog","versions":[{"version":"3.0","status":"affected"},{"version":"3.1","status":"affected"},{"version":"3.2","status":"affected"},{"version":"3.3","status":"affected"},{"version":"3.4","status":"affected"},{"version":"3.5.0","status":"affected"}],"modules":["Admin Panel"]}],"descriptions":[{"lang":"en","value":"A vulnerability was found in mtons mblog up to 3.5.0. The impacted element is an unknown function of the file /admin/user/list of the component Admin Panel. Performing manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used."},{"lang":"de","value":"In mtons mblog bis 3.5.0 wurde eine Schwachstelle gefunden. Es geht um eine nicht näher bekannte Funktion der Datei /admin/user/list der Komponente Admin Panel. Mit der Manipulation des Arguments Name mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Die Ausnutzung wurde veröffentlicht und kann verwendet werden."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"timeline":[{"time":"2025-08-25T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-08-25T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-08-25T11:46:13.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"ZAST.AI (VulDB User)","type":"reporter"}],"references":[{"url":"https://vuldb.com/?id.321274","name":"VDB-321274 | mtons mblog Admin Panel list cross site scripting","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321274","name":"VDB-321274 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.634169","name":"Submit #634169 | mtons https://gitee.com/mtons/mblog  <=3.5.0 Reflected XSS","tags":["third-party-advisory"]},{"url":"https://gitee.com/mtons/mblog/issues/ICPMMW","tags":["exploit","issue-tracking"]}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-08-26T20:24:55.391078Z","id":"CVE-2025-9433","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-08-26T20:25:03.194Z"}}]}}