Vulnerability · Published Jul 27, 2025 · Assigned by VulDB

CVE-2025-8221jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsCustController.java goodsSearch cross site scripting

Medium 4.3

In plain English

A medium-severity cross-site scripting in JPACookieShop 蛋糕商城JPA版 from jerryshensjf. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.6%top 52.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this vulnerability is the function goodsSearch of the file GoodsCustController.java. The manipulation of the argument keyword leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

Affected products (as reported)

Vendor	Product	Versions
jerryshensjf	JPACookieShop 蛋糕商城JPA版	24a15c02b4f75042c9f7f615a3fed2ec1cefb999

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-317809 | jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsCustController.java goodsSearch cross site scripting vdb-entry, technical-description
VDB-317809 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #621784 | Gitee jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0 Basic Cross Site Scripting third-party-advisory
https://github.com/Bemcliu/cve-reports/blob/main/cve-04-%E8%9B%8B%E7%B3%95%E5%95%86%E5%9F%8EJPA%E7%89%88-Reflected%20XSS/readme.md exploit