GitHub Advisoryadvisory · PyPI
GHSA-9cg4-9hv5-3376 WebSSH Cross-site Scripting vulnerability
LOW
Official page ↗
- Aliases
- CVE-2025-7885
- Ecosystem
- PyPI
- Packages
- webssh
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2025-09-15
Affected packages
• PyPI webssh: < 1.6.3 → fixed in 1.6.3
Description
A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument hostname/port leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Related
Alias · CVE (1)
- CVE-2025-7885 A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-7885 advisory
- https://github.com/huashengdun/webssh/issues/410 web
- https://github.com/huashengdun/webssh/commit/a7a704f111391c82efc1bacf89693ff45bda7f5f web
- https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-7885.md web
- https://github.com/huashengdun/webssh package
- https://github.com/pypa/advisory-database/tree/main/vulns/webssh/PYSEC-2025-234.yaml web
- https://vuldb.com/?ctiid.317000 web
- https://vuldb.com/?id.317000 web
- https://vuldb.com/?submit.613610 web