CVE-2025-65540

9th percentile - higher than 9% of all known CVEs

Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. Fields such as username and description are rendered directly into HTML without proper sanitization or encoding, allowing attackers to inject and execute malicious scripts.

An attacker can inject malicious JavaScript that executes in other users' browsers, enabling session theft or content manipulation.

Implement input sanitization and encoding for all user fields and apply Content-Security-Policy headers. Update xmall to a patched version.