CVE-2025-71164

Katalog CVE

CVSS 5.4 · Medium EPSS 0,23%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada typesettercms typesetter. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component. The images parameter (submitted as images[] in a POST request) is reflected into an HTML href attribute without proper context-aware output encoding in include/tool/Editing.php. An authenticated attacker with editing privileges can supply a JavaScript pseudo-protocol (e.g., javascript:) to trigger arbitrary JavaScript execution in the context of the victim's browser session.

Rincian

Terbit di NVD

14 Januari 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 13,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/typesetter-cms-reflected-xss-via-editing-php advisory pihak ketiga
• https://github.com/Typesetter/Typesetter/issues/706 exploit · issue tracking
• https://github.com/Typesetter/Typesetter product