CVE-2025-30148

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitized on the client-side, but server-side sanitization doesn't catch it. The server-side sanitization logic has been updated to sanitize against this attack. This vulnerability is fixed in 5.3.23.

• CWE-79

• https://github.com/silverstripe/silverstripe-framework/commit/e99cfd62d160d145a76fcf9631e6b11226e42358Patch
• https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-rhx4-hvx9-j387Vendor Advisory
• https://www.silverstripe.org/download/security-releases/cve-2025-30148Vendor Advisory

Published

Apr 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30141An issue was discovered on G-Net Dashcam BB GONX devices. On…7.5
• CVE-2025-30142An issue was discovered on G-Net Dashcam BB GONX devices. By…8.1
• CVE-2025-30143Rule 3000216 (before version 2) in Akamai App & API Protecto…5.4
• CVE-2025-30144fast-jwt provides fast JSON Web Token (JWT) implementation. …6.5
• CVE-2025-30145GeoServer is an open source server that allows users to shar…7.5
• CVE-2025-30147Besu Native contains scripts and tooling that is used to bui…8.7
• CVE-2025-30149OpenEMR is a free and open source electronic health records …4.6
• CVE-2025-3015A vulnerability classified as critical has been found in Ope…8.8
• CVE-2025-30150Shopware 6 is an open commerce platform based on Symfony Fra…5.3
• CVE-2025-30151Shopware is an open commerce platform. It's possible to pass…7.5
• CVE-2025-30152The Syliud PayPal Plugin is the Sylius Core Team’s plugin fo…6.5
• CVE-2025-30153kin-openapi is a Go project for handling OpenAPI files. Prio…7.5