CVE-2025-2491

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-2491

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-2491.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-2491

Published

2025-03-18T14:31:03.965Z

Modified

2026-07-15T01:49:13.547817856Z

Severity

4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Dromara ujcms Edit Template File Page WebFileTemplateController.java update cross site scripting

Details

A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/com/ujcms/cms/ext/web/backendapi/WebFileTemplateController.java of the component Edit Template File Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2491.json"
}

References

Affected packages

Git / github.com/dromara/ujcms

Affected ranges

Type

GIT

Repo

https://github.com/dromara/ujcms

Events

Introduced

ab2b382aeace6ba0dd6a271f6c5e3964dcee1c86

Last affected

ab2b382aeace6ba0dd6a271f6c5e3964dcee1c86

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "9.7.5"
        },
        {
            "last_affected": "9.7.5"
        }
    ],
    "cpe": "cpe:2.3:a:ujcms:ujcms:9.7.5:*:*:*:*:*:*:*"
}

Affected versions

9.*

9.7.5

v9.*

v9.7.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-2491.json"