CVE-2025-6050CWE-79

Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface

Medium · published June 17, 2025

CVSS v4.0
4.8
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_links.js" endpoint, causing the malicious script to execute in their browser.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N
EPSS
0.00315 · 23.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-06-17T11:06Z
EPSS history
Timeline
  • 17 JUN 11:06Z
    Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface
    cvelistv5