CVE-2025-15372

A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/views/system/notice/index.vue of the component Notice Handler. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-79
• CWE-94
• CWE-79

• https://github.com/AnalogyC0de/public_exp/blob/main/archives/vue3-element-admin/report.mdExploit, Third Party Advisory
• https://github.com/AnalogyC0de/public_exp/blob/main/archives/vue3-element-admin/report.md#proof-of-conceptExploit, Third Party Advisory
• https://vuldb.com/?ctiid.339080Permissions Required, VDB Entry
• https://vuldb.com/?id.339080Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.718345Third Party Advisory, VDB Entry
• https://github.com/AnalogyC0de/public_exp/blob/main/archives/vue3-element-admin/report.mdExploit, Third Party Advisory

Published

Dec 31, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-15367The poplib module, when passed a user-controlled command, ca…5.9
• CVE-2025-15368The SportsPress plugin for WordPress is vulnerable to Local …8.8
• CVE-2025-15369The Xpro Addons — 140+ Widgets for Elementor plugin for Word…5.3
• CVE-2025-1537A vulnerability was found in Harpia DiagSystem 12. It has be…6.3
• CVE-2025-15370The Shield: Blocks Bots, Protects Users, and Prevents Securi…4.3
• CVE-2025-15371A vulnerability has been found in Tenda i24, 4G03 Pro, 4G05,…7.8
• CVE-2025-15373A security vulnerability has been detected in EyouCMS up to …4.3
• CVE-2025-15374A vulnerability was detected in EyouCMS up to 1.7.7. The aff…5.4
• CVE-2025-15375A flaw has been found in EyouCMS up to 1.7.7. The impacted e…8.8
• CVE-2025-15376The Stopwords for comments plugin for WordPress is vulnerabl…4.3
• CVE-2025-15377The Sosh Share Buttons plugin for WordPress is vulnerable to…4.3
• CVE-2025-15378The AJS Footnotes plugin for WordPress is vulnerable to Stor…7.2