CVE-2025-30148mediumCWE-79

CVE-2025-30148: falha de média gravidade em silverstripe-framework

Silverstripe Framework has a XSS vulnerability in HTML editor

Publicada em

Seguir esta CVE+ Monitorar silverstripe-framework+ Monitorar silverstripe/framework

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.3%
Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitized on the client-side, but server-side sanitization doesn't catch it. The server-side sanitization logic has been updated to sanitize against this attack. This vulnerability is fixed in 5.3.23.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
silverstripe · silverstripe-framework
CVEs relacionadas — silverstripe-framework

No mesmo produto, das mais perigosas para as menos.

CVE-2023-22728MEDIUMSilverstripe Framework has missing permission check of canView in GridFieldPrintButtonEPSS 0.5%CVE-2023-22729MEDIUMSilverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen EPSS 0.4%CVE-2023-48714MEDIUMRecord titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleterEPSS 0.4%CVE-2024-32981MEDIUMCross-site Scripting vulnerability with encoded payload in silverstripe/frameworkEPSS 0.3%CVE-2024-53277MEDIUMCross-site Scripting in form messages in silverstripe frameworkEPSS 0.3%CVE-2026-54720MEDIUMSilverstripe Framework: Possible XSS attack through media embedEPSS 0.3%