CVE-2025-9430

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/options/update. The manipulation of the argument input results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
mtons	mblog	3.0; 3.1; 3.2; 3.3; 3.4; 3.5.0

References

https://gitee.com/mtons/mblog/issues/ICPMMFExploit, Issue Tracking
https://vuldb.com/?ctiid.321271Permissions Required, VDB Entry
https://vuldb.com/?id.321271Third Party Advisory, VDB Entry
https://vuldb.com/?submit.634156Third Party Advisory, VDB Entry

Timeline

Published: Aug 26, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-94316.1A flaw has been found in mtons mblog up to 3.5.0. Impacted is an unknown function of the file /search. This manipulation of the argument kw CVE-2025-94326.1A vulnerability has been found in mtons mblog up to 3.5.0. The affected element is an unknown function of the file /admin/post/list of the c CVE-2025-94336.1A vulnerability was found in mtons mblog up to 3.5.0. The impacted element is an unknown function of the file /admin/user/list of the compon CVE-2025-94346.1A vulnerability was determined in 1000projects Online Project Report Submission and Evaluation System 1.0. This affects an unknown function CVE-2025-94355.5Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module CVE-2025-94366.4The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `trustindex` shortcode in CVE-2025-94378.7A security issue exists within the Studio 5000 Logix Designer add-on profile (AOP) for the ArmorStart Classic distributed motor controller, CVE-2025-94386.1A security flaw has been discovered in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected is an unknown funct CVE-2025-94396.1A weakness has been identified in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this vulnerability is CVE-2025-94406.1A security vulnerability has been detected in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this issu CVE-2025-94416.5The iATS Online Forms plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order' parameter in all versions up to, and in CVE-2025-94426.4The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vodsChannel’ parameter in all