Vulnerability · Published May 17, 2025 · Assigned by VulDB

CVE-2025-4839itwanger paicoding CrossUtil.java cross-domain policy

Low 3.1

In plain English

A low-severity security flaw in paicoding from itwanger. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.3%top 76.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /paicoding-core/src/main/java/com/github/paicoding/forum/core/util/CrossUtil.java. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
itwanger	paicoding	1.0.01.0.11.0.21.0.3

Weakness: CWE-942, CWE-346 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

References

VDB-309307 | itwanger paicoding CrossUtil.java cross-domain policy vdb-entry
VDB-309307 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #574826 | itwanger paicoding from version 1.0.0 to 1.0.3 Permissive Cross-domain Policy with Untrusted Domains third-party-advisory
https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250510-02.md exploit