CVE-2025-1611
Shopxo ≤ 6.4.0
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-1611 is a medium-severity Injection (CWE-74) vulnerability in Shopxo Shopxo. Its CVSS base score is 5.1 (Medium).
Operationally, ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and CM-7 (Least Functionality) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4385
Vulnerability Data
A vulnerability was found in ShopXO up to 6.4.0. It has been classified as problematic. This affects an unknown part of the file app/service/ThemeAdminService.php of the component Template Handler. The manipulation leads to injection. It is possible to initiate the…
more
attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
- 6 hardening rules · 4 OS baselines
V1.3.9V1.2.1V1.2.3V1.2.5
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of all inputs to the ThemeAdminService template handler, blocking the CWE-74 injection vector before malicious payloads are processed.
Enforces least functionality by disabling or restricting dangerous template engine features and interpreters that the vulnerability exploits.
Requires integrity verification of template files and rendered output, enabling detection of unauthorized injection modifications in ShopXO.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and output encoding that prevent injection flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards directly require proper neutralization of inputs and outputs, eliminating CWE-707.
Security testing in development catches injection vulnerabilities before release.
Logging supports detection of injection attempts but does not prevent the weakness.
Monitoring activities can identify active injection attacks after they occur.
Secure development life cycle mandates input validation and output encoding that directly prevent injection flaws.
Application security requirements explicitly call for controls against injection attacks in software design.