Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.0

Bigotry OneBase 1.3.6 Cross-Site Scripting Risk

CVE-2025-7569 · published 1 year ago
Summary

A security flaw in Bigotry OneBase versions up to 1.3.6 could allow an attacker to inject malicious code into a website, potentially compromising user data. This is a serious issue because it allows a remote attack. Users should update to a fixed version of Bigotry OneBase as soon as possible to protect themselves.

Original advisory text
A vulnerability was found in Bigotry OneBase up to 1.3.6. It has been declared as problematic. Affected by this vulnerability is the function parse_args of the file /tpl/think_exception.tpl. The ma...
A vulnerability was found in Bigotry OneBase up to 1.3.6. It has been declared as problematic. Affected by this vulnerability is the function parse_args of the file /tpl/think_exception.tpl. The manipulation of the argument args leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.0 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
CWE-94Code Injection
Timeline
Published14 Jul 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-7569 · NVD
Track software like this
Free during beta