CVE-2025-60833

29th percentile - higher than 29% of all known CVEs

An XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying crafted XML data.

An attacker could exploit the XXE vulnerability to execute arbitrary code, potentially leading to system compromise or data leakage. This poses a serious threat to the confidentiality and integrity of the application.

Update uzy-ssm-mall to a version that fixes this vulnerability, or disable external XML entity processing in the parser configuration. Apply validation of XML input data.