CVE-2025-4839

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-4839

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4839.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-4839

Published

2025-05-17T22:00:06.221Z

Modified

2026-08-12T03:51:16.258773050Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

itwanger paicoding CrossUtil.java cross-domain policy

Details

A vulnerability has been found in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /paicoding-core/src/main/java/com/github/paicoding/forum/core/util/CrossUtil.java. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

Database specific

{
    "cwe_ids": [
        "CWE-346",
        "CWE-942"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/4xxx/CVE-2025-4839.json",
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0.0"
                },
                {
                    "last_affected": "1.0.0"
                },
                {
                    "introduced": "1.0.1"
                },
                {
                    "last_affected": "1.0.1"
                },
                {
                    "introduced": "1.0.2"
                },
                {
                    "last_affected": "1.0.2"
                },
                {
                    "introduced": "1.0.3"
                },
                {
                    "last_affected": "1.0.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/itwanger/paicoding

Affected ranges

Type

GIT

Repo

https://github.com/itwanger/paicoding

Events

Introduced

cc528f8d8b4139a41f18c180fd0a0015489e741f

Last affected

1fecb6e3135b07e664c3b546ceb74a167c0501f6

Database specific

Show details

{
    "cpe": [
        "cpe:2.3:a:itwanger:paicoding:1.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:itwanger:paicoding:1.0.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:itwanger:paicoding:1.0.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:itwanger:paicoding:1.0.3:*:*:*:*:*:*:*"
    ],
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "last_affected": "1.0.0"
        },
        {
            "introduced": "1.0.1"
        },
        {
            "last_affected": "1.0.1"
        },
        {
            "introduced": "1.0.2"
        },
        {
            "last_affected": "1.0.2"
        },
        {
            "introduced": "1.0.3"
        },
        {
            "last_affected": "1.0.3"
        }
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.3-微信支付

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-4839.json"