vulnwire
3.5low

CVE-2025-15134

yourmaileyes MOOC Submission MainController.java subreview cross site scripting

Published 10 mo ago · modified 32 d ago · JSON

CVSS
3.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 14%
Public exploits
0
none known

A security flaw has been discovered in yourmaileyes MOOC up to 1.17. This affects the function subreview of the file mooc/controller/MainController.java of the component Submission Handler. Performing manipulation of the argument review results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. The project was informed of the problem early through an issue report but has not responded yet.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
no
Technical impact
partial
Assessed
10 mo ago

Exploit prediction (EPSS)

0.23% probability of exploitation in the next 30 days, higher than 14% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.05.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CNA3.13.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
CNA3.03.5CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
CNA2.04.0AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR
CNA4.02.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA3.13.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CNA2.04.0AV:N/AC:L/Au:S/C:N/I:P/A:N

Affected products

  • yourmaileyes MOOC

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
  • CWE-94 Improper Control of Generation of Code

References

  • vuldb.com /?id.338512 · vdb-entry, technical-description
  • vuldb.com /?ctiid.338512 · signature, permissions-required
  • vuldb.com /?submit.713955 · third-party-advisory
  • github.com /yourmaileyes/MOOC/issues/12 · issue-tracking
  • github.com /yourmaileyes/MOOC/issues/12#issue-3722197285 · exploit, issue-tracking

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.