CVE-2025-6050

Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_links.js" endpoint, causing the malicious script to execute in their browser.

• CWE-79

• https://advisory.checkmarx.net/advisory/CVE-2025-6050/Exploit, Third Party Advisory
• https://github.com/stephenmcd/mezzanine/commit/898630d8df48cf3ddb8b9942f59168b93216e3f8Patch
• https://github.com/stephenmcd/mezzanine/discussions/2080Issue Tracking

Published

Jun 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-60477A NULL pointer dereference in the gf_filter_pid_resolve_file…5
• CVE-2025-60481A NULL pointer dereference in the gf_odf_ac4_cfg_dsi_v1 func…5.5
• CVE-2025-60483A NULL pointer dereference in the gf_ac4_pres_b_4_back_chann…5.5
• CVE-2025-60485A segmentation violation in the gf_isom_apple_set_tag_ex fun…5.5
• CVE-2025-60486A heap use-after-free in the dasher_process function (/filte…5.5
• CVE-2025-60495A segmentation violation in the gf_media_get_color_info func…5.5
• CVE-2025-60500QDocs Smart School Management System 7.1 allows authenticate…7.2
• CVE-2025-60503A cross-site scripting (XSS) vulnerability exists in the adm…8.7
• CVE-2025-60506Moodle PDF Annotator plugin v1.5 release 9 allows stored cro…5.4
• CVE-2025-60507Cross site scripting vulnerability in Moodle GeniAI plugin (…8.9
• CVE-2025-6051A Regular Expression Denial of Service (ReDoS) vulnerability…5.3
• CVE-2025-60511Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers f…4.3