CVE-2025-65956mediumCWE-79

CVE-2025-65956: falha de média gravidade em getformwork formwork

Formwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog Tags

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar formwork+ Monitorar getformwork/formwork

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.2%
Formwork is a flat file-based Content Management System (CMS). Prior to version 2.2.0, inserting unsanitized data into the blog tag field results in stored cross‑site scripting (XSS). Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controlled script executed in their browser. The issue is persistent and impacts privileged administrative workflows. This issue has been patched in version 2.2.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Produtos afetados
getformwork · formwork
CVEs relacionadas — getformwork formwork

No mesmo produto, das mais perigosas para as menos.

CVE-2024-37160MEDIUMFormwork has a Cross-site scripting (XSS) vulnerability in Description metadataEPSS 0.5%CVE-2026-27198HIGHFormwork Improperly Manages Privileges During User CreationEPSS 0.5%CVE-2026-104478HIGHFormwork before 2.3.13 Path Traversal via BackupController Download and DeleteEPSS 0.4%CVE-2026-105950MEDIUMgetformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scriptingEPSS 0.2%