PT-2025-35148

CVE-2025-9591

Published

2025-08-28

Updated

2026-09-26

Description by

CVSS 2.0

3.3

Low

MetricsAV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ZrLog versions up to 3.1.5

Description A security vulnerability exists in ZrLog, potentially allowing for cross site scripting. The vulnerability affects unknown code within the /api/admin/template/config file of the Theme Configuration Form component. Manipulation of the footerLink argument can trigger the issue. The exploit has been publicly disclosed.

Recommendations Versions prior to 3.1.5 should be updated.

Exploitability

Exploit

Fix

Impacts

Researchers

Saas5Saas

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')