CVE-2025-15095

LowCVSS 3.5/10Last modified Oct 11, 2026

Description

A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file httpbin-master/httpbin/core.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Dec 26, 2025
Last modified
Oct 11, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-150968.8The 'Videospirecore Theme Plugin' plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, andCVE-2025-150977.3A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. PerformiCVE-2025-150986.3A vulnerability was determined in YunaiV yudao-cloud up to 2025.11. This affects the function BpmHttpCallbackTrigger/BpmSyncHttpRequestTriggCVE-2025-150999.8A vulnerability was identified in simstudioai sim up to 0.5.27. This vulnerability affects unknown code of the file apps/sim/lib/auth/internCVE-2025-15109.8The The Custom Post Type Date Archives plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includCVE-2025-151008.8The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is duCVE-2025-151018.8An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administratoCVE-2025-151029.8DVP-12SE11T - Password Protection BypassCVE-2025-151039.8DVP-12SE11T - Authentication Bypass via Partial Password DisclosureCVE-2025-151045.3Nu Html Checker (validator.nu) contains a restriction bypass that allows remote attackers to make the server perform arbitrary HTTP/HTTPS reCVE-2025-151055.9A security flaw has been discovered in getmaxun maxun up to 0.0.28. Impacted is an unknown function of the file /getmaxun/maxun/blob/developCVE-2025-151064.3A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the file server/src/routes