CVE-2025-15454

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15454", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-01-04T08:57:15.895Z", "datePublished": "2026-01-05T03:02:06.427Z", "dateUpdated": "2026-02-23T08:16:22.344Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:16:22.344Z"}, "title": "zhanglun lettura RSS ContentRender.tsx cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "zhanglun", "product": "lettura", "versions": [{"version": "0.1.0", "status": "affected"}, {"version": "0.1.1", "status": "affected"}, {"version": "0.1.2", "status": "affected"}, {"version": "0.1.3", "status": "affected"}, {"version": "0.1.4", "status": "affected"}, {"version": "0.1.5", "status": "affected"}, {"version": "0.1.6", "status": "affected"}, {"version": "0.1.7", "status": "affected"}, {"version": "0.1.8", "status": "affected"}, {"version": "0.1.9", "status": "affected"}, {"version": "0.1.10", "status": "affected"}, {"version": "0.1.11", "status": "affected"}, {"version": "0.1.12", "status": "affected"}, {"version": "0.1.13", "status": "affected"}, {"version": "0.1.14", "status": "affected"}, {"version": "0.1.15", "status": "affected"}, {"version": "0.1.16", "status": "affected"}, {"version": "0.1.17", "status": "affected"}, {"version": "0.1.18", "status": "affected"}, {"version": "0.1.19", "status": "affected"}, {"version": "0.1.20", "status": "affected"}, {"version": "0.1.21", "status": "affected"}, {"version": "0.1.22", "status": "affected"}], "modules": ["RSS Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/ArticleView/ContentRender.tsx of the component RSS Handler. The manipulation results in cross site scripting. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used. The patch is identified as 67213093db9923e828a6e3fd8696a998c85da2d4. It is best practice to apply a patch to resolve this issue."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.1, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-01-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-01-04T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-01-05T07:17:34.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "cranb3rry (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.339487", "name": "VDB-339487 | zhanglun lettura RSS ContentRender.tsx cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.339487", "name": "VDB-339487 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.725038", "name": "Submit #725038 | lettura v0.1.22 XSS", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3", "tags": ["related"]}, {"url": "https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3#proof-of-concept", "tags": ["exploit"]}, {"url": "https://github.com/zhanglun/lettura/commit/67213093db9923e828a6e3fd8696a998c85da2d4", "tags": ["patch"]}, {"url": "https://github.com/zhanglun/lettura/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-06T18:54:21.323738Z", "id": "CVE-2025-15454", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T18:54:30.494Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15454", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-06T18:54:21.323738Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T18:54:26.216Z"}}], "cna": {"tags": ["x_open-source"], "title": "zhanglun lettura RSS ContentRender.tsx cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "cranb3rry (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "zhanglun", "modules": ["RSS Handler"], "product": "lettura", "versions": [{"status": "affected", "version": "0.1.0"}, {"status": "affected", "version": "0.1.1"}, {"status": "affected", "version": "0.1.2"}, {"status": "affected", "version": "0.1.3"}, {"status": "affected", "version": "0.1.4"}, {"status": "affected", "version": "0.1.5"}, {"status": "affected", "version": "0.1.6"}, {"status": "affected", "version": "0.1.7"}, {"status": "affected", "version": "0.1.8"}, {"status": "affected", "version": "0.1.9"}, {"status": "affected", "version": "0.1.10"}, {"status": "affected", "version": "0.1.11"}, {"status": "affected", "version": "0.1.12"}, {"status": "affected", "version": "0.1.13"}, {"status": "affected", "version": "0.1.14"}, {"status": "affected", "version": "0.1.15"}, {"status": "affected", "version": "0.1.16"}, {"status": "affected", "version": "0.1.17"}, {"status": "affected", "version": "0.1.18"}, {"status": "affected", "version": "0.1.19"}, {"status": "affected", "version": "0.1.20"}, {"status": "affected", "version": "0.1.21"}, {"status": "affected", "version": "0.1.22"}]}], "timeline": [{"lang": "en", "time": "2026-01-04T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-01-04T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-01-05T07:17:34.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.339487", "name": "VDB-339487 | zhanglun lettura RSS ContentRender.tsx cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.339487", "name": "VDB-339487 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.725038", "name": "Submit #725038 | lettura v0.1.22 XSS", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3", "tags": ["related"]}, {"url": "https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3#proof-of-concept", "tags": ["exploit"]}, {"url": "https://github.com/zhanglun/lettura/commit/67213093db9923e828a6e3fd8696a998c85da2d4", "tags": ["patch"]}, {"url": "https://github.com/zhanglun/lettura/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/ArticleView/ContentRender.tsx of the component RSS Handler. The manipulation results in cross site scripting. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used. The patch is identified as 67213093db9923e828a6e3fd8696a998c85da2d4. It is best practice to apply a patch to resolve this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:16:22.344Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15454", "state": "PUBLISHED", "dateUpdated": "2026-02-23T08:16:22.344Z", "dateReserved": "2026-01-04T08:57:15.895Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-01-05T03:02:06.427Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["RSS Handler"], "product": "lettura", "vendor": "zhanglun", "versions": [{"status": "affected", "version": "0.1.0"}, {"status": "affected", "version": "0.1.1"}, {"status": "affected", "version": "0.1.2"}, {"status": "affected", "version": "0.1.3"}, {"status": "affected", "version": "0.1.4"}, {"status": "affected", "version": "0.1.5"}, {"status": "affected", "version": "0.1.6"}, {"status": "affected", "version": "0.1.7"}, {"status": "affected", "version": "0.1.8"}, {"status": "affected", "version": "0.1.9"}, {"status": "affected", "version": "0.1.10"}, {"status": "affected", "version": "0.1.11"}, {"status": "affected", "version": "0.1.12"}, {"status": "affected", "version": "0.1.13"}, {"status": "affected", "version": "0.1.14"}, {"status": "affected", "version": "0.1.15"}, {"status": "affected", "version": "0.1.16"}, {"status": "affected", "version": "0.1.17"}, {"status": "affected", "version": "0.1.18"}, {"status": "affected", "version": "0.1.19"}, {"status": "affected", "version": "0.1.20"}, {"status": "affected", "version": "0.1.21"}, {"status": "affected", "version": "0.1.22"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/ArticleView/ContentRender.tsx of the component RSS Handler. The manipulation results in cross site scripting. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit is now public and may be used. The patch is identified as 67213093db9923e828a6e3fd8696a998c85da2d4. It is best practice to apply a patch to resolve this issue."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en zhanglun lettura hasta 0.1.22. Este problema afecta a alg\u00fan procesamiento desconocido del archivo src/components/ArticleView/ContentRender.tsx del componente RSS Handler. La manipulaci\u00f3n resulta en cross site scripting. El ataque puede ser ejecutado remotamente. Este ataque se caracteriza por alta complejidad. La explotabilidad se eval\u00faa como dif\u00edcil. El exploit es ahora p\u00fablico y puede ser usado. El parche se identifica como 67213093db9923e828a6e3fd8696a998c85da2d4. Es una buena pr\u00e1ctica aplicar un parche para resolver este problema."}], "id": "CVE-2025-15454", "lastModified": "2026-10-07T11:10:00.153", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15454", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-06T18:54:21.323738Z", "version": "2.0.3"}}]}, "published": "2026-01-05T03:15:50.477", "references": [{"source": "cna@vuldb.com", "url": "https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3"}, {"source": "cna@vuldb.com", "url": "https://gist.github.com/youremailaddress/cba7c19a4eafcb326d0e912adf132be3#proof-of-concept"}, {"source": "cna@vuldb.com", "url": "https://github.com/zhanglun/lettura/"}, {"source": "cna@vuldb.com", "url": "https://github.com/zhanglun/lettura/commit/67213093db9923e828a6e3fd8696a998c85da2d4"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.339487"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.339487"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.725038"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"created": "2026-01-06T14:17:48.724351+00:00", "updated": "2026-01-06T14:17:48.724379+00:00", "vendors": ["zhanglun", "zhanglun$PRODUCT$lettura"]}