Threats Tagged 'cve-2025-12290'

CVE-2025-12290 is a medium-severity cross-site scripting (XSS) vulnerability found in version 1.0 of the Suishang Enterprise-Level B2B2C Multi-User Mall System by Sui Shang Information Technology. The vulnerability arises from improper sanitization of the 'keywords' parameter in the /i/359 endpoint, allowing remote attackers to inject malicious scripts. Exploitation does not require authentication but does require user interaction, such as clicking a crafted link. Although no known exploits are currently observed in the wild, the vulnerability has been publicly disclosed and the vendor has not responded to notifications. This flaw could enable attackers to steal session cookies, perform actions on behalf of users, or deliver malware via the affected web application. European organizations using this e-commerce platform may face risks to customer data confidentiality and integrity, as well as reputational damage. Mitigation involves implementing strict input validation and output encoding on the affected parameter, deploying web application firewalls with XSS detection, and monitoring for suspicious activity. Countries with higher adoption of this platform or significant e-commerce sectors, such as Germany, France, and the UK, are more likely to be impacted. Given the ease of remote exploitation without authentication, the vulnerability warrants medium severity classification.

MediumVulnerabilityGermanyFranceItaly+3#cve#cve-2025-12290