VDB
CVE-2025-2361
CVE-2025-2361
PUBLISHED
CVSS 5 MEDIUM
A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
EPSS 0.51% · 41.6th percentile
Risk Scores
CVSS 2.0
5
EPSS Score
0.51%
41.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mercurial | SCM | 4.5.3, 71.19.145.211 |
Timeline
- Mar 17, 2025 EPSS Score
- Mar 17, 2025 CVE Published
- Mar 17, 2025 PoC Published
- Mar 18, 2025 Coalition ESS Score
- Mar 21, 2025 Coalition ESS Score
- Mar 27, 2025 Coalition ESS Score
- Mar 27, 2025 CVE Updated
- Mar 31, 2025 EPSS Score
- Apr 14, 2025 EPSS Score
- Apr 28, 2025 EPSS Score
- May 12, 2025 EPSS Score
- May 26, 2025 EPSS Score
References
- https://lists.debian.org/debian-lts-announce/2025/03/msg00020.html advisory
- VDB-299860 | Mercurial SCM Web Interface cross site scripting vdb
- VDB-299860 | CTI Indicators (IOB, IOC, TTP, IOA) url
- Submit #514024 | Mercurial Mercurial SCM Web Interface 4.5.3 CRLF Injection leads to Cross-Site Scripting third-party-advisory
- http://www.openwall.com/lists/oss-security/2025/03/21/2 url
- https://nvd.nist.gov/vuln/detail/CVE-2025-2361 advisory