CVE-2025-60833

Published: Oct 8, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying crafted XML data.

Affected (1)

Products: Ghostxbh: Uzy Ssm Mall

Ghostxbh

1 product

Uzy Ssm Mall

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ghostxbh Uzy Ssm Mall	Version 1.1.0

Related CWEs

CWE-91

XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

References (2)

https://gist.github.com/ChangeYourWay/1364b9e78490ebd5cd31bcdc105a914f

Source: cve@mitre.org

Third Party Advisory

https://github.com/ChangeYourWay/post/blob/main/uzy-ssm-mall.md

Source: cve@mitre.org

ExploitThird Party Advisory

Timeline

No history available yet.