CVE-2025-2194

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-2194

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-2194.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-2194

Published

2025-03-11T13:31:04.585Z

Modified

2026-07-15T01:49:20.302220701Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

MRCMS org.marker.mushroom.controller.FileController list.do list cross site scripting

Details

A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects the function list of the file /admin/file/list.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument path leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2194.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "3.1.2"
                },
                {
                    "last_affected": "3.1.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/wuweiit/mushroom

Affected ranges

Type

GIT

Repo

https://github.com/wuweiit/mushroom

Events

Introduced

e287c4915e0b542f0920cf76437afe2354cd0249

Last affected

e287c4915e0b542f0920cf76437afe2354cd0249

Database specific

{
    "cpe": "cpe:2.3:a:mrcms:mrcms:3.1.2:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.1.2"
        },
        {
            "last_affected": "3.1.2"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

3.*

3.1.2

v3.*

v3.1.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-2194.json"