Vulnerability · Published Dec 26, 2025 · Assigned by VulDB

CVE-2025-15095postmanlabs httpbin core.py cross site scripting

Low 3.5

In plain English

A low-severity cross-site scripting in httpbin from postmanlabs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.3%top 79.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file httpbin-master/httpbin/core.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
postmanlabs	httpbin	0.6.00.6.1

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-338424 | postmanlabs httpbin core.py cross site scripting vdb-entry
VDB-338424 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #709002 | postmanlabs httpbin <=0.6.1 XSS third-party-advisory
https://github.com/postmanlabs/httpbin/issues/735 exploit, issue-tracking