CVE-2025-11304CWE-346CWE-942

CVE-2025-11304

Medium · published October 6, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
11.6
In the wild
Unconfirmed
What it is

A flaw has been found in CodeCanyon/ui-lib Mentor LMS up to 1.1.1. Affected by this vulnerability is an unknown functionality of the component API. Executing manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00218 · 11.6th percentile
Weaknesses
CWE-346 · Origin Validation Error; CWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains
Published
2025-10-06T01:15Z
References (7)
https://github.com/PlsRevert/CVEs/issues/3 · [email protected]https://github.com/PlsRevert/CVEs/issues/3#issue-3447867888 · [email protected]https://vuldb.com/?ctiid.327185 · [email protected]https://vuldb.com/?id.327185 · [email protected]https://vuldb.com/?submit.661733 · [email protected]https://github.com/PlsRevert/CVEs/issues/3 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/PlsRevert/CVEs/issues/3#issue-3447867888 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 05 OCT 21:02Z
    CodeCanyon/ui-lib Mentor LMS API cross-domain policy
    cvelistv5