CVE-2025-67349CWE-79cross-site-scripting

CVE-2025-67349

Medium · published December 26, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
20.6
In the wild
Unconfirmed
What it is

A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the application fails to properly sanitize input in the <head> section, allowing remote attackers to inject arbitrary script tags.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00292 · 20.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-26T20:15Z
Affected products (1)
ProductVersionsFixed in
fluentcms/fluentcmsall versions—
References (2)
https://github.com/eoniboogie/CVE_Disclosures/blob/main/CVE-2025-67349/CVE-2025-67349.md · [email protected]https://github.com/fluentcms/FluentCMS/issues/2403 · [email protected]
EPSS history
Timeline
  • 26 DEC 00:00Z
    A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3
    cvelistv5