CVE-2025-6551

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in java-aodeng Hope-Boot 1.0.0 and classified as problematic. This issue affects the function Login of the file /src/main/java/com/hope/controller/WebController.java. The manipulation of the argument errorMsg leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
java-aodeng	Hope-Boot	1.0.0

References

https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-01/report.mdExploit, Third Party Advisory
https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-01/report.md#steps-to-reproduceExploit, Third Party Advisory
https://vuldb.com/?ctiid.313691Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.313691Third Party Advisory, VDB Entry
https://vuldb.com/?submit.596615Third Party Advisory, VDB Entry
https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250613-01/report.mdExploit, Third Party Advisory

Timeline

Published: Jun 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-655127.5A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 an CVE-2025-655137.5fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP v CVE-2025-655166.1A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is conf CVE-2025-655187.5Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability exists in the get_pas CVE-2025-655196.5mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in JSON and XML file import processing. The application f CVE-2025-65524.3A vulnerability was found in java-aodeng Hope-Boot 1.0.0. It has been classified as problematic. Affected is the function doLogin of the fil CVE-2025-65539.8The Ovatheme Events Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_CVE-2025-655308.8An eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows attackers to overwrite arbitrary files CVE-2025-65548.1Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pa CVE-2025-655406.1Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields su CVE-2025-655489.1NUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell (cashubtc/nuts) before 0.18.0 do not validate the size of p CVE-2025-65555.4Use after free in Animation in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to potentially exploit heap corruption via a c