CVE-2025-14801

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in xiweicheng TMS up to 2.28.0. This affects the function createComment of the file /admin/blog/comment/create. Such manipulation of the argument content leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
xiweicheng	TMS	2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8; 2.9; 2.10; 2.11; 2.12; 2.13; 2.14; 2.15; 2.16; 2.17; 2.18; 2.19

References

https://github.com/ha1yu-Yiqiyin/warehouse/blob/main/TMS_v2.28.0_XSS-1.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.336939Permissions Required, VDB Entry
https://vuldb.com/?id.336939Third Party Advisory, VDB Entry
https://vuldb.com/?submit.708322Third Party Advisory, VDB Entry

Timeline

Published: Dec 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-148025.4The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and including, 4.3.2.2 vi CVE-2025-148036.8The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms WordPress plugin before 9.1.8 CVE-2025-148047.7The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any auth CVE-2025-148065.7IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive,CVE-2025-148076.5IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to HTTP header injection, caused by improper validation of input b CVE-2025-148083.1IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an attacker to obtain sensitive information from the query string of CVE-2025-148097.4ArcSearch for Android versions prior to 1.12.6 could display a different domain in the address bar than the content being shown, enabling ad CVE-2025-14814.3The Shortcode Cleaner Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the downlo CVE-2025-148106.5IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 does not invalidate a session after privileges have been modified which could al CVE-2025-148115.9IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive info CVE-2025-148127.5ArcSearch for iOS versions prior to 1.45.2 could display a different domain in the address bar than the content being shown after an iframe-CVE-2025-148137.5: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules).