CVE-2025-25287

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-25287
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25287.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-25287
Aliases
  • GHSA-mq77-3q68-v64v
Published
2025-02-13T15:28:40.074Z
Modified
2026-07-15T02:14:09.293693320Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Lakeus vulnerable to stored XSS via system messages
Details

Lakeus is a simple skin made for MediaWiki. Starting in version 1.0.8 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus is vulnerable to store cross-site scripting via malicious system messages, though editing the messages requires high privileges. Those with (editinterface) rights can edit system messages that are improperly handled in order to send raw HTML. In the case of lakeus-footermessage, this will affect all users if the server is configured to link back to this repository. Otherwise, the system messages in themeDesigner.js are only used when the user enables it in their preferences. Versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0 contain a patch.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25287.json",
    "cna_assigner": "GitHub_M",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": ">= 1.0.8, < 1.3.1+REL1.39"
                },
                {
                    "last_affected": ">= 1.0.8, < 1.3.1+REL1.39"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/lakejason0/mediawiki-skins-lakeus

Affected ranges

Type
GIT
Repo
https://github.com/lakejason0/mediawiki-skins-lakeus
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fb79928f06efa47677fff27e0f4755eb32b1c8d9
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

1.*
1.0.15
Other
REL1_36
REL1_37
REL1_38
REL1_40
REL1_41
v1.*
v1.0.0
v1.0.1
v1.0.10
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.18
v1.0.19
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.14
v1.1.15
v1.1.18
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.2.0
v1.2.1
v1.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25287.json"