Yüksek CVSS 7.1 PoC var
CVE-2025-63589: Cmsimple Xh: siteler arası betik çalıştırma (XSS)
Açıklama (NVD)
A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs, search form action, footer links). An attacker-controlled string placed in the URL path is reflected into multiple HTML elements, allowing execution of arbitrary JavaScript in victims' browsers visiting a crafted URL.
Özet bilgiler
- Ürün
- Cmsimple-xh Cmsimple Xh
- CVSS v3.1
- 7.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - EPSS
- %0,36 (yüzdelik 29)
- CWE
- CWE-79
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| cmsimple-xh-cmsimple-xh | 1.8.0 | 1.8.0 | — |