CVE-2025-25287

Lakeus is a simple skin made for MediaWiki. Starting in version 1.0.8 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus is vulnerable to store cross-site scripting via malicious system messages, though editing the messages requires high privileges. Those with `(editinterface)` rights can edit system messages that are improperly handled in order to send raw HTML. In the case of `lakeus-footermessage`, this will affect all users if the server is configured to link back to this repository. Otherwise, the system messages in themeDesigner.js are only used when the user enables it in their preferences. Versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0 contain a patch.

• CWE-79

• https://github.com/lakejason0/mediawiki-skins-Lakeus/blob/82ad2cd341f85b814a6a0f37969e6210ebf2521d/includes/SkinLakeus.php#L27
• https://github.com/lakejason0/mediawiki-skins-Lakeus/blob/82ad2cd341f85b814a6a0f37969e6210ebf2521d/resources/themeDesigner.js
• https://github.com/lakejason0/mediawiki-skins-Lakeus/commit/fb79928f06efa47677fff27e0f4755eb32b1c8d9
• https://github.com/lakejason0/mediawiki-skins-Lakeus/security/advisories/GHSA-mq77-3q68-v64v

Published

Feb 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25281An attacker may modify the URL to discover sensitive informa…7.5
• CVE-2025-25282RAGFlow is an open-source RAG (Retrieval-Augmented Generatio…8.1
• CVE-2025-25283parse-duraton is software that allows users to convert a hum…7.5
• CVE-2025-25284The ZOO-Project is an open source processing platform, relea…8.7
• CVE-2025-25285@octokit/endpoint turns REST API endpoints into generic requ…5.3
• CVE-2025-25286Crayfish is a collection of Islandora 8 microservices, one o…9.8
• CVE-2025-25288@octokit/plugin-paginate-rest is the Octokit plugin to pagin…5.3
• CVE-2025-25289@octokit/request-error is an error class for Octokit request…5.3
• CVE-2025-2529Applications using affected versions of Ehcache 3.x can expe…3.7
• CVE-2025-25290@octokit/request sends parameterized requests to GitHub’s AP…5.3
• CVE-2025-25291ruby-saml provides security assertion markup language (SAML)…9.8
• CVE-2025-25292ruby-saml provides security assertion markup language (SAML)…9.8