CVE-2025-2712
published 2025-03-24CVE-2025-2712: A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the…
PriorityP179medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
0.79%
51.6th percentile
A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /help/top.jsp. The manipulation of the argument langcode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| yonyou | ufida_erp-nc | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url{{BaseURL}}/help/top.jsp?langcode=1%22%3E%3Csvg%20onload=alert(document.domain)%3E
url{{BaseURL}}/help/top.jsp?langcode=1%22%3E%3C/script%3E%3Csvg%20onload=alert(document.domain)%3E
otherfofa-query: icon_hash="1085941792"
- →Detect exploitation attempts by monitoring GET requests to /help/top.jsp or /help/systop.jsp containing SVG/script injection payloads in the langcode parameter (e.g., URL-encoded '<svg onload=', '</script>').
- →Fingerprint vulnerable Yonyou UFIDA ERP-NC instances using FOFA icon hash 1085941792.
- →Confirm exploitation by checking HTTP 200 responses with Content-Type text/html containing both '.png)' and 'Search.jsp' in the body, indicating the vulnerable help page was rendered with injected input.
- ·The vulnerability affects both /help/top.jsp and /help/systop.jsp, but the NVD entry only explicitly references /help/top.jsp. Both paths should be monitored.
- ·The Nuclei template uses stop-at-first-match, meaning only one of the two exploit URL variants will be tested per scan run; both paths should be independently validated in detection logic.
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vulncheck5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pc7g-pr5v-48jw: A vulnerability was found in Yonyou UFIDA ERP-NC 5
ghsa_unreviewed·2025-03-25
CVE-2025-2712 [MEDIUM] CWE-79 GHSA-pc7g-pr5v-48jw: A vulnerability was found in Yonyou UFIDA ERP-NC 5
A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /help/top.jsp. The manipulation of the argument langcode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
VulnCheck
yonyou ufida_erp-nc Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulncheck·2025·CVSS 5.3
CVE-2025-2712 [MEDIUM] yonyou ufida_erp-nc Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
yonyou ufida_erp-nc Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /help/top.jsp. The manipulation of the argument langcode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected: yonyou ufida_erp-nc
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://app.crowdsec.net/cti/cve-explorer/CVE-
No detection rules found.
Nuclei
Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
nuclei·CVSS 5.3
CVE-2025-2712 [MEDIUM] Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
Template:
id: CVE-2025-2712
info:
name: Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting
author: ritikchaddha
severity: medium
description: |
Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
impact: |
Attackers can inject malicious JavaScript through the langcode parameter in help pages, potentially stealing user crede
No writeups or analysis indexed.
2025-03-24
Published
Exploited in the wild