CVE-2025-15437

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15437", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-01-01T18:32:26.321Z", "datePublished": "2026-01-02T08:32:06.186Z", "dateUpdated": "2026-02-23T08:09:16.451Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:09:16.451Z"}, "title": "LigeroSmart Environment Variable cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "n/a", "product": "LigeroSmart", "versions": [{"version": "6.1.0", "status": "affected"}, {"version": "6.1.1", "status": "affected"}, {"version": "6.1.2", "status": "affected"}, {"version": "6.1.3", "status": "affected"}, {"version": "6.1.4", "status": "affected"}, {"version": "6.1.5", "status": "affected"}, {"version": "6.1.6", "status": "affected"}, {"version": "6.1.7", "status": "affected"}, {"version": "6.1.8", "status": "affected"}, {"version": "6.1.9", "status": "affected"}, {"version": "6.1.10", "status": "affected"}, {"version": "6.1.11", "status": "affected"}, {"version": "6.1.12", "status": "affected"}, {"version": "6.1.13", "status": "affected"}, {"version": "6.1.14", "status": "affected"}, {"version": "6.1.15", "status": "affected"}, {"version": "6.1.16", "status": "affected"}, {"version": "6.1.17", "status": "affected"}, {"version": "6.1.18", "status": "affected"}, {"version": "6.1.19", "status": "affected"}, {"version": "6.1.20", "status": "affected"}, {"version": "6.1.21", "status": "affected"}, {"version": "6.1.22", "status": "affected"}, {"version": "6.1.23", "status": "affected"}, {"version": "6.1.24", "status": "affected"}, {"version": "6.1.26", "status": "unaffected"}, {"version": "6.3", "status": "unaffected"}], "modules": ["Environment Variable Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in LigeroSmart up to 6.1.24. This affects an unknown part of the component Environment Variable Handler. Performing a manipulation of the argument REQUEST_URI results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 6.1.26 and 6.3 is able to mitigate this issue. The patch is named 264ac5b2be5b3c673ebd8cb862e673f5d300d9a7. The affected component should be upgraded."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-01-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-01-01T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-01-07T10:32:43.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "chor4o (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.339364", "name": "VDB-339364 | LigeroSmart Environment Variable cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.339364", "name": "VDB-339364 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.729021", "name": "Submit #729021 | LigeroSmart 6.1.24 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/issues/278", "tags": ["issue-tracking"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/issues/278#issuecomment-3675129508", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/commit/264ac5b2be5b3c673ebd8cb862e673f5d300d9a7", "tags": ["patch"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/releases/tag/6.1.26", "tags": ["patch"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-06T20:15:05.351675Z", "id": "CVE-2025-15437", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T20:15:19.414Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15437", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-06T20:15:05.351675Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T20:15:13.296Z"}}], "cna": {"tags": ["x_open-source"], "title": "LigeroSmart Environment Variable cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "chor4o (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "n/a", "modules": ["Environment Variable Handler"], "product": "LigeroSmart", "versions": [{"status": "affected", "version": "6.1.0"}, {"status": "affected", "version": "6.1.1"}, {"status": "affected", "version": "6.1.2"}, {"status": "affected", "version": "6.1.3"}, {"status": "affected", "version": "6.1.4"}, {"status": "affected", "version": "6.1.5"}, {"status": "affected", "version": "6.1.6"}, {"status": "affected", "version": "6.1.7"}, {"status": "affected", "version": "6.1.8"}, {"status": "affected", "version": "6.1.9"}, {"status": "affected", "version": "6.1.10"}, {"status": "affected", "version": "6.1.11"}, {"status": "affected", "version": "6.1.12"}, {"status": "affected", "version": "6.1.13"}, {"status": "affected", "version": "6.1.14"}, {"status": "affected", "version": "6.1.15"}, {"status": "affected", "version": "6.1.16"}, {"status": "affected", "version": "6.1.17"}, {"status": "affected", "version": "6.1.18"}, {"status": "affected", "version": "6.1.19"}, {"status": "affected", "version": "6.1.20"}, {"status": "affected", "version": "6.1.21"}, {"status": "affected", "version": "6.1.22"}, {"status": "affected", "version": "6.1.23"}, {"status": "affected", "version": "6.1.24"}, {"status": "unaffected", "version": "6.1.26"}, {"status": "unaffected", "version": "6.3"}]}], "timeline": [{"lang": "en", "time": "2026-01-01T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-01-01T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-01-07T10:32:43.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.339364", "name": "VDB-339364 | LigeroSmart Environment Variable cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.339364", "name": "VDB-339364 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.729021", "name": "Submit #729021 | LigeroSmart 6.1.24 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/issues/278", "tags": ["issue-tracking"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/issues/278#issuecomment-3675129508", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/commit/264ac5b2be5b3c673ebd8cb862e673f5d300d9a7", "tags": ["patch"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/releases/tag/6.1.26", "tags": ["patch"]}, {"url": "https://github.com/LigeroSmart/ligerosmart/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in LigeroSmart up to 6.1.24. This affects an unknown part of the component Environment Variable Handler. Performing a manipulation of the argument REQUEST_URI results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 6.1.26 and 6.3 is able to mitigate this issue. The patch is named 264ac5b2be5b3c673ebd8cb862e673f5d300d9a7. The affected component should be upgraded."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:09:16.451Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15437", "state": "PUBLISHED", "dateUpdated": "2026-02-23T08:09:16.451Z", "dateReserved": "2026-01-01T18:32:26.321Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-01-02T08:32:06.186Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Environment Variable Handler"], "product": "LigeroSmart", "vendor": "n/a", "versions": [{"status": "affected", "version": "6.1.0"}, {"status": "affected", "version": "6.1.1"}, {"status": "affected", "version": "6.1.2"}, {"status": "affected", "version": "6.1.3"}, {"status": "affected", "version": "6.1.4"}, {"status": "affected", "version": "6.1.5"}, {"status": "affected", "version": "6.1.6"}, {"status": "affected", "version": "6.1.7"}, {"status": "affected", "version": "6.1.8"}, {"status": "affected", "version": "6.1.9"}, {"status": "affected", "version": "6.1.10"}, {"status": "affected", "version": "6.1.11"}, {"status": "affected", "version": "6.1.12"}, {"status": "affected", "version": "6.1.13"}, {"status": "affected", "version": "6.1.14"}, {"status": "affected", "version": "6.1.15"}, {"status": "affected", "version": "6.1.16"}, {"status": "affected", "version": "6.1.17"}, {"status": "affected", "version": "6.1.18"}, {"status": "affected", "version": "6.1.19"}, {"status": "affected", "version": "6.1.20"}, {"status": "affected", "version": "6.1.21"}, {"status": "affected", "version": "6.1.22"}, {"status": "affected", "version": "6.1.23"}, {"status": "affected", "version": "6.1.24"}, {"status": "unaffected", "version": "6.1.26"}, {"status": "unaffected", "version": "6.3"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ligerosmart:ligerosmart:*:*:*:*:*:*:*:*", "matchCriteriaId": "B77D3C25-59EA-487F-A514-AB4279A163BC", "versionEndIncluding": "6.1.24", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in LigeroSmart up to 6.1.24. This affects an unknown part of the component Environment Variable Handler. Performing a manipulation of the argument REQUEST_URI results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 6.1.26 and 6.3 is able to mitigate this issue. The patch is named 264ac5b2be5b3c673ebd8cb862e673f5d300d9a7. The affected component should be upgraded."}, {"lang": "es", "value": "Una vulnerabilidad fue encontrada en LigeroSmart hasta 6.1.24. Esto afecta una parte desconocida del componente Environment Variable Handler. Realizar la manipulaci\u00f3n del argumento REQUEST_URI resulta en cross site scripting. El ataque puede ser iniciado remotamente. El exploit ha sido hecho p\u00fablico y podr\u00eda ser usado. Actualizar a la versi\u00f3n 6.1.26 y 6.3 es capaz de mitigar este problema. El parche se llama 264ac5b2be5b3c673ebd8cb862e673f5d300d9a7. El componente afectado deber\u00eda ser actualizado."}], "id": "CVE-2025-15437", "lastModified": "2026-07-25T11:10:00.100", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15437", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-06T20:15:05.351675Z", "version": "2.0.3"}}]}, "published": "2026-01-02T09:15:42.453", "references": [{"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://github.com/LigeroSmart/ligerosmart/"}, {"source": "cna@vuldb.com", "tags": ["Patch"], "url": "https://github.com/LigeroSmart/ligerosmart/commit/264ac5b2be5b3c673ebd8cb862e673f5d300d9a7"}, {"source": "cna@vuldb.com", "tags": ["Issue Tracking"], "url": "https://github.com/LigeroSmart/ligerosmart/issues/278"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/LigeroSmart/ligerosmart/issues/278#issuecomment-3675129508"}, {"source": "cna@vuldb.com", "tags": ["Release Notes"], "url": "https://github.com/LigeroSmart/ligerosmart/releases/tag/6.1.26"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.339364"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.339364"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.729021"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}