CVE-2025-30148CWE-79

Silverstripe Framework has a XSS vulnerability in HTML editor

Medium · published April 10, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitized on the client-side, but server-side sanitization doesn't catch it. The server-side sanitization logic has been updated to sanitize against this attack. This vulnerability is fixed in 5.3.23.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00292 · 20.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-04-10T13:02Z
EPSS history
Timeline
  • 10 APR 13:02Z
    Silverstripe Framework has a XSS vulnerability in HTML editor
    cvelistv5