CVE-2025-25287

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-25287
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25287.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-25287
Aliases
  • GHSA-mq77-3q68-v64v
Published
2025-02-13T16:16:49Z
Modified
2025-02-14T01:57:04.606681Z
Summary
[none]
Details

Lakeus is a simple skin made for MediaWiki. Starting in version 1.8.0 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus is vulnerable to store cross-site scripting via malicious system messages, though editing the messages requires high privileges. Those with (editinterface) rights can edit system messages that are improperly handled in order to send raw HTML. In the case of lakeus-footermessage, this will affect all users if the server is configured to link back to this repository. Otherwise, the system messages in themeDesigner.js are only used when the user enables it in their preferences. Versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0 contain a patch.

References

Affected packages

Git / github.com/lakejason0/mediawiki-skins-lakeus

Affected ranges

Type
GIT
Repo
https://github.com/lakejason0/mediawiki-skins-lakeus
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fb79928f06efa47677fff27e0f4755eb32b1c8d9

Affected versions

1.*

1.0.15

v1.*

v1.0.0
v1.0.1
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.18
v1.0.19
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.14
v1.1.15
v1.1.16
v1.1.17
v1.1.18
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.2.0
v1.2.1
v1.3.0