Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
8 vulnerabilities by ExpressGateway
CVE-2026-107177 (GCVE-0-2026-107177)
Vulnerability from nvd – Published: 2026-10-07 12:48 – Updated: 2026-10-07 17:31 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens
Summary
Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 17:27 UTC
CWE
- CWE-1394 - Use of Default Cryptographic Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ExpressGateway/express-gateway… | issue-tracking |
| https://github.com/ExpressGateway/express-gateway | product |
| https://github.com/ExpressGateway/express-gateway… | technical-description |
| https://github.com/ExpressGateway/express-gateway… | technical-description |
| https://www.vulncheck.com/advisories/express-gate… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ExpressGateway | express-gateway |
Affected:
0 , ≤ 1.16.11
(semver)
cpe:2.3:a:express-gateway:express-gateway_docker_image:*:*:*:*:*:*:*:* |
Date Public
2026-10-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107177",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T17:27:31.854378Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:31:24.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ExpressGateway/express-gateway/issues/1078"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/express-gateway",
"product": "express-gateway",
"vendor": "ExpressGateway",
"versions": [
{
"lessThanOrEqual": "1.16.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:express-gateway:express-gateway_docker_image:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.16.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "MD Mahmidul Hasan"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey \u0027sensitiveKey\u0027. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1394",
"description": "Use of Default Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T12:48:19.043Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1078",
"tags": [
"issue-tracking"
],
"url": "https://github.com/ExpressGateway/express-gateway/issues/1078"
},
{
"tags": [
"product"
],
"url": "https://github.com/ExpressGateway/express-gateway"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/config/system.config.yml#L15-L22"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/services/utils.js#L18-L28"
},
{
"name": "VulnCheck Advisory: Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/express-gateway-through-1.16.11-hardcoded-default-cipherkey-exposes-oauth-tokens"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107177",
"datePublished": "2026-10-07T12:48:19.043Z",
"dateReserved": "2026-10-07T12:40:26.059Z",
"dateUpdated": "2026-10-07T17:31:24.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107162 (GCVE-0-2026-107162)
Vulnerability from nvd – Published: 2026-10-07 12:48 – Updated: 2026-10-07 12:48 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass
Summary
Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that user's access token and impersonate them against oauth2-protected APIs.
Severity
CWE
- CWE-287 - Improper Authentication
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ExpressGateway/express-gateway… | issue-tracking |
| https://github.com/ExpressGateway/express-gateway | product |
| https://github.com/ExpressGateway/express-gateway… | technical-description |
| https://github.com/ExpressGateway/express-gateway… | technical-description |
| https://www.vulncheck.com/advisories/express-gate… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ExpressGateway | express-gateway |
Affected:
0 , ≤ 1.16.11
(semver)
cpe:2.3:a:express-gateway:express-gateway_docker_image:*:*:*:*:*:*:*:* |
Date Public
2026-10-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/express-gateway",
"product": "express-gateway",
"vendor": "ExpressGateway",
"versions": [
{
"lessThanOrEqual": "1.16.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:express-gateway:express-gateway_docker_image:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.16.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "MD Mahmidul Hasan"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user\u0027s refresh token can obtain that user\u0027s access token and impersonate them against oauth2-protected APIs."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T12:48:18.499Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1076",
"tags": [
"issue-tracking"
],
"url": "https://github.com/ExpressGateway/express-gateway/issues/1076"
},
{
"tags": [
"product"
],
"url": "https://github.com/ExpressGateway/express-gateway"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/policies/oauth2/oauth2-server.js#L221-L247"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/services/tokens/token.service.js#L100-L136"
},
{
"name": "VulnCheck Advisory: Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/express-gateway-through-1.16.11-oauth-2.0-refresh-token-validation-bypass"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107162",
"datePublished": "2026-10-07T12:48:18.499Z",
"dateReserved": "2026-10-07T11:02:13.828Z",
"dateUpdated": "2026-10-07T12:48:18.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9096 (GCVE-0-2025-9096)
Vulnerability from nvd – Published: 2025-08-17 23:32 – Updated: 2025-08-18 17:27
VLAI
EPSS
VEX
Title
ExpressGateway express-gateway REST Endpoint apps.js cross site scripting
Summary
A vulnerability has been found in ExpressGateway express-gateway up to 1.16.10. Affected is an unknown function in the library lib/rest/routes/apps.js of the component REST Endpoint. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-18 17:14 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.320418 | vdb-entry |
| https://vuldb.com/?ctiid.320418 | signaturepermissions-required |
| https://vuldb.com/?submit.627833 | third-party-advisory |
| https://github.com/freshfish-hust/my-cves/issues/6 | issue-tracking |
| https://github.com/freshfish-hust/my-cves/issues/… | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ExpressGateway | express-gateway |
Affected:
1.16.0
Affected: 1.16.1 Affected: 1.16.2 Affected: 1.16.3 Affected: 1.16.4 Affected: 1.16.5 Affected: 1.16.6 Affected: 1.16.7 Affected: 1.16.8 Affected: 1.16.9 Affected: 1.16.10 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9096",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-18T17:14:30.428462Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-18T17:27:38.727Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"REST Endpoint"
],
"product": "express-gateway",
"vendor": "ExpressGateway",
"versions": [
{
"status": "affected",
"version": "1.16.0"
},
{
"status": "affected",
"version": "1.16.1"
},
{
"status": "affected",
"version": "1.16.2"
},
{
"status": "affected",
"version": "1.16.3"
},
{
"status": "affected",
"version": "1.16.4"
},
{
"status": "affected",
"version": "1.16.5"
},
{
"status": "affected",
"version": "1.16.6"
},
{
"status": "affected",
"version": "1.16.7"
},
{
"status": "affected",
"version": "1.16.8"
},
{
"status": "affected",
"version": "1.16.9"
},
{
"status": "affected",
"version": "1.16.10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Haoatao (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in ExpressGateway express-gateway up to 1.16.10. Affected is an unknown function in the library lib/rest/routes/apps.js of the component REST Endpoint. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "In ExpressGateway express-gateway bis 1.16.10 wurde eine Schwachstelle gefunden. Dabei betrifft es einen unbekannter Codeteil in der Bibliothek lib/rest/routes/apps.js der Komponente REST Endpoint. Durch Beeinflussen mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-17T23:32:05.435Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-320418 | ExpressGateway express-gateway REST Endpoint apps.js cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.320418"
},
{
"name": "VDB-320418 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.320418"
},
{
"name": "Submit #627833 | GitHub Web Application Express Gateway 1.16.10 and possibly earlier Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.627833"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/freshfish-hust/my-cves/issues/6"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/freshfish-hust/my-cves/issues/6#issue-3287078206"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-08-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-08-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-08-17T14:59:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "ExpressGateway express-gateway REST Endpoint apps.js cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-9096",
"datePublished": "2025-08-17T23:32:05.435Z",
"dateReserved": "2025-08-17T12:53:58.111Z",
"dateUpdated": "2025-08-18T17:27:38.727Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-9095 (GCVE-0-2025-9095)
Vulnerability from nvd – Published: 2025-08-17 23:02 – Updated: 2025-08-18 17:33
VLAI
EPSS
VEX
Title
ExpressGateway express-gateway REST Endpoint users.js cross site scripting
Summary
A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of the component REST Endpoint. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-18 17:32 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.320417 | vdb-entry |
| https://vuldb.com/?ctiid.320417 | signaturepermissions-required |
| https://vuldb.com/?submit.627709 | third-party-advisory |
| https://github.com/freshfish-hust/my-cves/issues/5 | issue-tracking |
| https://github.com/freshfish-hust/my-cves/issues/… | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ExpressGateway | express-gateway |
Affected:
1.16.0
Affected: 1.16.1 Affected: 1.16.2 Affected: 1.16.3 Affected: 1.16.4 Affected: 1.16.5 Affected: 1.16.6 Affected: 1.16.7 Affected: 1.16.8 Affected: 1.16.9 Affected: 1.16.10 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9095",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-18T17:32:31.371269Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-18T17:33:04.638Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"REST Endpoint"
],
"product": "express-gateway",
"vendor": "ExpressGateway",
"versions": [
{
"status": "affected",
"version": "1.16.0"
},
{
"status": "affected",
"version": "1.16.1"
},
{
"status": "affected",
"version": "1.16.2"
},
{
"status": "affected",
"version": "1.16.3"
},
{
"status": "affected",
"version": "1.16.4"
},
{
"status": "affected",
"version": "1.16.5"
},
{
"status": "affected",
"version": "1.16.6"
},
{
"status": "affected",
"version": "1.16.7"
},
{
"status": "affected",
"version": "1.16.8"
},
{
"status": "affected",
"version": "1.16.9"
},
{
"status": "affected",
"version": "1.16.10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Haoatao (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of the component REST Endpoint. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in ExpressGateway express-gateway bis 1.16.10 entdeckt. Dies betrifft einen unbekannten Teil in der Bibliothek lib/rest/routes/users.js der Komponente REST Endpoint. Durch das Beeinflussen mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-17T23:02:07.148Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-320417 | ExpressGateway express-gateway REST Endpoint users.js cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.320417"
},
{
"name": "VDB-320417 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.320417"
},
{
"name": "Submit #627709 | GitHub Web Application Express Gateway 1.16.10 and possibly earlier Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.627709"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/freshfish-hust/my-cves/issues/5"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/freshfish-hust/my-cves/issues/5#issue-3286622393"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-08-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-08-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-08-17T14:59:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "ExpressGateway express-gateway REST Endpoint users.js cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-9095",
"datePublished": "2025-08-17T23:02:07.148Z",
"dateReserved": "2025-08-17T12:53:49.035Z",
"dateUpdated": "2025-08-18T17:33:04.638Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-107177 (GCVE-0-2026-107177)
Vulnerability from cvelistv5 – Published: 2026-10-07 12:48 – Updated: 2026-10-07 17:31 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens
Summary
Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 17:27 UTC
CWE
- CWE-1394 - Use of Default Cryptographic Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ExpressGateway/express-gateway… | issue-tracking |
| https://github.com/ExpressGateway/express-gateway | product |
| https://github.com/ExpressGateway/express-gateway… | technical-description |
| https://github.com/ExpressGateway/express-gateway… | technical-description |
| https://www.vulncheck.com/advisories/express-gate… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ExpressGateway | express-gateway |
Affected:
0 , ≤ 1.16.11
(semver)
cpe:2.3:a:express-gateway:express-gateway_docker_image:*:*:*:*:*:*:*:* |
Date Public
2026-10-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107177",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T17:27:31.854378Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T17:31:24.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ExpressGateway/express-gateway/issues/1078"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/express-gateway",
"product": "express-gateway",
"vendor": "ExpressGateway",
"versions": [
{
"lessThanOrEqual": "1.16.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:express-gateway:express-gateway_docker_image:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.16.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "MD Mahmidul Hasan"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey \u0027sensitiveKey\u0027. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1394",
"description": "Use of Default Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T12:48:19.043Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1078",
"tags": [
"issue-tracking"
],
"url": "https://github.com/ExpressGateway/express-gateway/issues/1078"
},
{
"tags": [
"product"
],
"url": "https://github.com/ExpressGateway/express-gateway"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/config/system.config.yml#L15-L22"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/services/utils.js#L18-L28"
},
{
"name": "VulnCheck Advisory: Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/express-gateway-through-1.16.11-hardcoded-default-cipherkey-exposes-oauth-tokens"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107177",
"datePublished": "2026-10-07T12:48:19.043Z",
"dateReserved": "2026-10-07T12:40:26.059Z",
"dateUpdated": "2026-10-07T17:31:24.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107162 (GCVE-0-2026-107162)
Vulnerability from cvelistv5 – Published: 2026-10-07 12:48 – Updated: 2026-10-07 12:48 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass
Summary
Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that user's access token and impersonate them against oauth2-protected APIs.
Severity
CWE
- CWE-287 - Improper Authentication
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ExpressGateway/express-gateway… | issue-tracking |
| https://github.com/ExpressGateway/express-gateway | product |
| https://github.com/ExpressGateway/express-gateway… | technical-description |
| https://github.com/ExpressGateway/express-gateway… | technical-description |
| https://www.vulncheck.com/advisories/express-gate… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ExpressGateway | express-gateway |
Affected:
0 , ≤ 1.16.11
(semver)
cpe:2.3:a:express-gateway:express-gateway_docker_image:*:*:*:*:*:*:*:* |
Date Public
2026-10-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/express-gateway",
"product": "express-gateway",
"vendor": "ExpressGateway",
"versions": [
{
"lessThanOrEqual": "1.16.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:express-gateway:express-gateway_docker_image:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.16.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "MD Mahmidul Hasan"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user\u0027s refresh token can obtain that user\u0027s access token and impersonate them against oauth2-protected APIs."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T12:48:18.499Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1076",
"tags": [
"issue-tracking"
],
"url": "https://github.com/ExpressGateway/express-gateway/issues/1076"
},
{
"tags": [
"product"
],
"url": "https://github.com/ExpressGateway/express-gateway"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/policies/oauth2/oauth2-server.js#L221-L247"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ExpressGateway/express-gateway/blob/45612814d12f65889ef3bdf80b2ed7ab9b557736/lib/services/tokens/token.service.js#L100-L136"
},
{
"name": "VulnCheck Advisory: Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/express-gateway-through-1.16.11-oauth-2.0-refresh-token-validation-bypass"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107162",
"datePublished": "2026-10-07T12:48:18.499Z",
"dateReserved": "2026-10-07T11:02:13.828Z",
"dateUpdated": "2026-10-07T12:48:18.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-9096 (GCVE-0-2025-9096)
Vulnerability from cvelistv5 – Published: 2025-08-17 23:32 – Updated: 2025-08-18 17:27
VLAI
EPSS
VEX
Title
ExpressGateway express-gateway REST Endpoint apps.js cross site scripting
Summary
A vulnerability has been found in ExpressGateway express-gateway up to 1.16.10. Affected is an unknown function in the library lib/rest/routes/apps.js of the component REST Endpoint. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-18 17:14 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.320418 | vdb-entry |
| https://vuldb.com/?ctiid.320418 | signaturepermissions-required |
| https://vuldb.com/?submit.627833 | third-party-advisory |
| https://github.com/freshfish-hust/my-cves/issues/6 | issue-tracking |
| https://github.com/freshfish-hust/my-cves/issues/… | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ExpressGateway | express-gateway |
Affected:
1.16.0
Affected: 1.16.1 Affected: 1.16.2 Affected: 1.16.3 Affected: 1.16.4 Affected: 1.16.5 Affected: 1.16.6 Affected: 1.16.7 Affected: 1.16.8 Affected: 1.16.9 Affected: 1.16.10 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9096",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-18T17:14:30.428462Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-18T17:27:38.727Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"REST Endpoint"
],
"product": "express-gateway",
"vendor": "ExpressGateway",
"versions": [
{
"status": "affected",
"version": "1.16.0"
},
{
"status": "affected",
"version": "1.16.1"
},
{
"status": "affected",
"version": "1.16.2"
},
{
"status": "affected",
"version": "1.16.3"
},
{
"status": "affected",
"version": "1.16.4"
},
{
"status": "affected",
"version": "1.16.5"
},
{
"status": "affected",
"version": "1.16.6"
},
{
"status": "affected",
"version": "1.16.7"
},
{
"status": "affected",
"version": "1.16.8"
},
{
"status": "affected",
"version": "1.16.9"
},
{
"status": "affected",
"version": "1.16.10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Haoatao (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in ExpressGateway express-gateway up to 1.16.10. Affected is an unknown function in the library lib/rest/routes/apps.js of the component REST Endpoint. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "In ExpressGateway express-gateway bis 1.16.10 wurde eine Schwachstelle gefunden. Dabei betrifft es einen unbekannter Codeteil in der Bibliothek lib/rest/routes/apps.js der Komponente REST Endpoint. Durch Beeinflussen mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-17T23:32:05.435Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-320418 | ExpressGateway express-gateway REST Endpoint apps.js cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.320418"
},
{
"name": "VDB-320418 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.320418"
},
{
"name": "Submit #627833 | GitHub Web Application Express Gateway 1.16.10 and possibly earlier Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.627833"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/freshfish-hust/my-cves/issues/6"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/freshfish-hust/my-cves/issues/6#issue-3287078206"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-08-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-08-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-08-17T14:59:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "ExpressGateway express-gateway REST Endpoint apps.js cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-9096",
"datePublished": "2025-08-17T23:32:05.435Z",
"dateReserved": "2025-08-17T12:53:58.111Z",
"dateUpdated": "2025-08-18T17:27:38.727Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-9095 (GCVE-0-2025-9095)
Vulnerability from cvelistv5 – Published: 2025-08-17 23:02 – Updated: 2025-08-18 17:33
VLAI
EPSS
VEX
Title
ExpressGateway express-gateway REST Endpoint users.js cross site scripting
Summary
A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of the component REST Endpoint. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-18 17:32 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.320417 | vdb-entry |
| https://vuldb.com/?ctiid.320417 | signaturepermissions-required |
| https://vuldb.com/?submit.627709 | third-party-advisory |
| https://github.com/freshfish-hust/my-cves/issues/5 | issue-tracking |
| https://github.com/freshfish-hust/my-cves/issues/… | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ExpressGateway | express-gateway |
Affected:
1.16.0
Affected: 1.16.1 Affected: 1.16.2 Affected: 1.16.3 Affected: 1.16.4 Affected: 1.16.5 Affected: 1.16.6 Affected: 1.16.7 Affected: 1.16.8 Affected: 1.16.9 Affected: 1.16.10 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9095",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-18T17:32:31.371269Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-18T17:33:04.638Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"REST Endpoint"
],
"product": "express-gateway",
"vendor": "ExpressGateway",
"versions": [
{
"status": "affected",
"version": "1.16.0"
},
{
"status": "affected",
"version": "1.16.1"
},
{
"status": "affected",
"version": "1.16.2"
},
{
"status": "affected",
"version": "1.16.3"
},
{
"status": "affected",
"version": "1.16.4"
},
{
"status": "affected",
"version": "1.16.5"
},
{
"status": "affected",
"version": "1.16.6"
},
{
"status": "affected",
"version": "1.16.7"
},
{
"status": "affected",
"version": "1.16.8"
},
{
"status": "affected",
"version": "1.16.9"
},
{
"status": "affected",
"version": "1.16.10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Haoatao (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of the component REST Endpoint. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in ExpressGateway express-gateway bis 1.16.10 entdeckt. Dies betrifft einen unbekannten Teil in der Bibliothek lib/rest/routes/users.js der Komponente REST Endpoint. Durch das Beeinflussen mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-17T23:02:07.148Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-320417 | ExpressGateway express-gateway REST Endpoint users.js cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.320417"
},
{
"name": "VDB-320417 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.320417"
},
{
"name": "Submit #627709 | GitHub Web Application Express Gateway 1.16.10 and possibly earlier Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.627709"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/freshfish-hust/my-cves/issues/5"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/freshfish-hust/my-cves/issues/5#issue-3286622393"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-08-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-08-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-08-17T14:59:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "ExpressGateway express-gateway REST Endpoint users.js cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-9095",
"datePublished": "2025-08-17T23:02:07.148Z",
"dateReserved": "2025-08-17T12:53:49.035Z",
"dateUpdated": "2025-08-18T17:33:04.638Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}