Vulnerability · Published Sep 25, 2025 · Assigned by VulDB

CVE-2025-10944yi-ge get-header-ip ip.php cross site scripting

Low 3.5

In plain English

A low-severity cross-site scripting in get-header-ip from yi-ge. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.3%top 82.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in yi-ge get-header-ip up to 589b23d0eb0043c310a6a13ce4bbe2505d0d0b15. This issue affects the function ip of the file ip.php. This manipulation of the argument callback causes cross site scripting. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
yi-ge	get-header-ip	589b23d0eb0043c310a6a13ce4bbe2505d0d0b15

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R

References

VDB-325814 | yi-ge get-header-ip ip.php cross site scripting vdb-entry, technical-description
VDB-325814 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #651884 | yi-ge get-header-ip master CWE-79 third-party-advisory
https://github.com/yi-ge/get-header-ip/blob/master/ip.php#L32 related