CVE-2025-15505

LowCVSS 2.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in Luxul XWR-600 up to 4.0.1. The affected element is an unknown function of the component Web Administration Interface. The manipulation of the argument Guest Network/Wireless Profile SSID results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond with a technical statement.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jan 11, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-155063.3A vulnerability was found in AcademySoftwareFoundation OpenColorIO up to 2.5.0. This issue affects the function ConvertToRegularExpression o CVE-2025-155075.3The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec CVE-2025-155085.3The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin CVE-2025-155094.3The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage.CVE-2025-15516.1IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, and 9.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows CVE-2025-155105.3The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF CVE-2025-155115.3The Rupantorpay plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_webh CVE-2025-155125.3The Aplazo Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the CVE-2025-155135.3The Float Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to improper error handling in the veri CVE-2025-155147.5Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing CVE-2025-155155.5The authentication mechanism for a specific feature in the EasyShare module contains a vulnerability. If specific conditions are met on a lo CVE-2025-155164.3The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th