CVE-2025-15372

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/views/system/notice/index.vue of the component Notice Handler. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
youlaitech	vue3-element-admin	3.0; 3.1; 3.2; 3.3; 3.4.0

References

https://github.com/AnalogyC0de/public_exp/blob/main/archives/vue3-element-admin/report.mdExploit, Third Party Advisory
https://github.com/AnalogyC0de/public_exp/blob/main/archives/vue3-element-admin/report.md#proof-of-conceptExploit, Third Party Advisory
https://vuldb.com/?ctiid.339080Permissions Required, VDB Entry
https://vuldb.com/?id.339080Third Party Advisory, VDB Entry
https://vuldb.com/?submit.718345Third Party Advisory, VDB Entry
https://github.com/AnalogyC0de/public_exp/blob/main/archives/vue3-element-admin/report.mdExploit, Third Party Advisory

Timeline

Published: Dec 31, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-153734.3A security vulnerability has been detected in EyouCMS up to 1.7.7. Impacted is the function saveRemote of the file application/function.php.CVE-2025-153745.4A vulnerability was detected in EyouCMS up to 1.7.7. The affected element is an unknown function of the file application/home/model/Ask.php CVE-2025-153758.8A flaw has been found in EyouCMS up to 1.7.7. The impacted element is the function unserialize of the file application/api/controller/Ajax.p CVE-2025-153764.3The Stopwords for comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This CVE-2025-153774.3The Sosh Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is CVE-2025-153787.2The AJS Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note_list_class' and 'popup_display_effect_in' CVE-2025-1537910.0A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_depend CVE-2025-15388.8A vulnerability classified as critical was found in D-Link DAP-1320 1.00. Affected by this vulnerability is the function set_ws_action of th CVE-2025-153807.2The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification CVE-2025-153817.1In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permissi CVE-2025-153828.1A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote attacker can trigger th CVE-2025-153859.8Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authentication Bypass.This issue a