GHSA-4f2v-2gpq-qhjg

Source

https://github.com/advisories/GHSA-4f2v-2gpq-qhjg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-4f2v-2gpq-qhjg/GHSA-4f2v-2gpq-qhjg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4f2v-2gpq-qhjg

Aliases

CVE-2025-2699

Published

2025-03-24T09:34:03Z

Modified

2025-03-24T21:37:04.089458Z

Severity

3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

GetmeUK ContentTools Cross-Site Scripting (XSS)

Details

A vulnerability was found in GetmeUK ContentTools up to 1.6.16. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Image Handler. The manipulation of the argument onload leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-24T21:24:05Z",
    "nvd_published_at": "2025-03-24T08:15:12Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE"
}

References

Affected packages

npm / ContentTools

Package

Name: ContentTools; View open source insights on deps.dev
Purl: pkg:npm/ContentTools

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.6.16