High severity · published May 24, 2025
CVE-2025-5132
Tmall Demo logout cross-site request forgery
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was found in Tmall Demo up to 20250505. It has been rated as problematic. This issue affects some unknown processing of the file tmall/admin/account/logout. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
Demo · Tmall
20250505 · source: vendor
TD
Tmall Demo · Project Team
through 2025-05-05 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-5132
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-5132
Exploit
https://github.com/bdkuzma/vuln/issues/11
Permissions Required
https://vuldb.com/?ctiid.310211
Third Party Advisory
https://vuldb.com/?id.310211
Third Party Advisory
https://vuldb.com/?submit.571924
More from Demo
7.2
CVE-2025-5131
Tmall Demo uploadCategoryImage unrestricted upload
7.2
CVE-2025-5130
Tmall Demo uploadProductImage unrestricted upload
6.1
CVE-2025-5135
Tmall Demo Product Details Page admin cross site scripting
6.1
CVE-2025-5134
Tmall Demo Buy Item Page cross site scripting
6.1
CVE-2025-5133
Tmall Demo Search Box cross site scripting
