What is CVE-2025-9797?

CVE-2025-9797 is a low-severity vulnerability in Mrvautin Expresscart, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 2.4/10. Published 2025-09-01.

How severe is CVE-2025-9797?

Low severity. CVSS v3 base score is 2.4 out of 10.

Is CVE-2025-9797 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Mrvautin Expresscart

CVE-2025-9797

A vulnerability was determined in mrvautin expressCart up to b31302f4e99c3293bd742c6d076a721e168118b0. This impacts an unknown function of the file /admin/product/edit/ of the component Edit Product Page. This manipulation causes injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.

EPSS: 0.002 (16.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 2.4 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N.

Affected products

Mrvautin Expresscart — versions b31302f4e99c3293bd742c6d076a721e168118b0

Weakness classification (CWE)

Public proof-of-concept exploits

References

cna@vuldb.com (vdb-entry)
cna@vuldb.com (signature, permissions-required)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (issue-tracking)
cna@vuldb.com (issue-tracking, exploit)

Frequently asked questions

What is CVE-2025-9797?: CVE-2025-9797 is a low-severity vulnerability in Mrvautin Expresscart, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 2.4/10. Published 2025-09-01.
How severe is CVE-2025-9797?: Low severity. CVSS v3 base score is 2.4 out of 10.
Is CVE-2025-9797 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.