CVE-2025-25460

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-25460

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25460.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-25460

Published

2025-02-24T00:00:00Z

Modified

2026-08-12T03:51:38.200657725Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts, which are executed when other users view the posts. The issue arises due to improper input sanitization of the "TextArea" field in the blog entry submission form.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25460.json"
}

References

Affected packages

Git / github.com/flatpressblog/flatpress

Affected ranges

Type

GIT

Repo

https://github.com/flatpressblog/flatpress

Events

Introduced

e3525112643d83f1d96b87f5d209bd9de8d78330

Last affected

e3525112643d83f1d96b87f5d209bd9de8d78330

Database specific

Show details

{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:flatpress:flatpress:1.3.1:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.3.1"
        },
        {
            "last_affected": "1.3.1"
        }
    ]
}

Affected versions

1.*

1.3.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25460.json"