CVE-2025-28886

Summary

CVE-2025-28886 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the xjb REST API TO MiniProgram. This issue permits unauthorized command execution, leading to potential data theft or unintended actions. The flaw is present in versions 4.7.1 and below of the REST API TO MiniProgram. An attacker can successfully exploit this CSRF vulnerability by crafting a malicious request that is executed when an unsuspecting user visits a specially crafted webpage. The attacker can then manipulate the user's session, resulting in unauthorized access or unintended interactions with the targeted system. Users are advised to upgrade to the latest version of the API as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.