CVE-2025-5887

A vulnerability was found in jsnjfz WebStack-Guns 1.0. It has been classified as problematic. Affected is an unknown function of the file UserMgrController.java of the component File Upload. The manipulation of the argument File leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
Link Resource
https://github.com/Aiyakami/CVE-1/issues/4 Exploit Third Party Advisory
https://vuldb.com/?ctiid.311658 Permissions Required VDB Entry
https://vuldb.com/?id.311658 Third Party Advisory VDB Entry
https://vuldb.com/?submit.580744 Exploit Third Party Advisory VDB Entry
https://github.com/Aiyakami/CVE-1/issues/4 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:jsnjfz:webstack-guns:1.0:*:*:*:*:*:*:*

History

10 Jul 2025, 16:19

Type Values Removed Values Added
CPE cpe:2.3:a:jsnjfz:webstack-guns:1.0:*:*:*:*:*:*:*
First Time Jsnjfz
Jsnjfz webstack-guns
References () https://github.com/Aiyakami/CVE-1/issues/4 - () https://github.com/Aiyakami/CVE-1/issues/4 - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.311658 - () https://vuldb.com/?ctiid.311658 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.311658 - () https://vuldb.com/?id.311658 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.580744 - () https://vuldb.com/?submit.580744 - Exploit, Third Party Advisory, VDB Entry

12 Jun 2025, 16:06

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en jsnjfz WebStack-Guns 1.0. Se ha clasificado como problemática. Se ve afectada una función desconocida del archivo UserMgrController.java del componente File Upload. La manipulación del argumento File provoca ataques de cross site scripting. Es posible ejecutar el ataque de forma remota. Se ha hecho público el exploit y puede que sea utilizado. Se contactó al proveedor con antelación sobre esta divulgación, pero no respondió.

09 Jun 2025, 20:15

Type Values Removed Values Added
References () https://github.com/Aiyakami/CVE-1/issues/4 - () https://github.com/Aiyakami/CVE-1/issues/4 -

09 Jun 2025, 17:15

Type Values Removed Values Added
New CVE

Information

Published : 2025-06-09 17:15

Updated : 2025-07-10 16:19


NVD link : CVE-2025-5887

Mitre link : CVE-2025-5887

CVE.ORG link : CVE-2025-5887


JSON object : View

Products Affected

jsnjfz

  • webstack-guns
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')