CVE-2025-10485
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-15

Last updated on: 2026-04-29

Assigner: VulDB

Description
A vulnerability has been found in pojoin h3blog up to 5bf704425ebc11f4c24da51f32f36bb17ae20489. Affected by this issue is the function ppt_log of the file /login of the component HTTP Header Handler. Such manipulation of the argument X-Forwarded-For leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-15
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2025-09-16
EPSS Evaluated
2026-06-15
NVD
CVE-2025-10485
EUVD
EUVD-2025-29354
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
pojoin h3blog *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the pojoin h3blog software, specifically in the ppt_log function of the /login component's HTTP Header Handler. It involves manipulation of the X-Forwarded-For argument, which can lead to a cross-site scripting (XSS) attack. This means an attacker can inject malicious scripts remotely through this header, potentially affecting users who interact with the vulnerable component.

Impact Analysis

The vulnerability can allow an attacker to perform cross-site scripting attacks remotely by manipulating the X-Forwarded-For header. This can lead to the execution of malicious scripts in the context of users' browsers, potentially resulting in unauthorized actions, session hijacking, or other malicious activities. The CVSS scores indicate a low to medium severity with impact primarily on integrity but not confidentiality or availability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-10485. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart