6.5

CVE-2025-25973

Exploit
A stored Cross Site Scripting vulnerability in the "related recommendations" feature in Ppress v.0.0.9 allows a remote attacker to execute arbitrary code via a crafted script to the article.title, article.category, and article.tags parameters.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Yandaozi ≫ Ppress Version 0.0.9 Update beta
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.53% 0.413
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://gist.github.com/coleak2021/512acaa12ba0987499d560967acff1d1
Patch
Third Party Advisory
Mitigation
https://github.com/yandaozi/PPress/issues/3
Exploit
Issue Tracking