CVE-2025-67349
Last modified
CVE-2025-67349 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the application fails to properly sanitize input in the <head> section, allowing remote attackers to inject arbitrary script tags.. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the application fails to properly sanitize input in the <head> section, allowing remote attackers to inject arbitrary script tags.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fluentcms | Fluentcms | 1.2.3 |
References
- https://github.com/eoniboogie/CVE_Disclosures/blob/main/CVE-2025-67349/CVE-2025-67349.mdExploit, Third Party Advisory
- https://github.com/fluentcms/FluentCMS/issues/2403Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-67349?
How severe is CVE-2025-67349?
How do I fix CVE-2025-67349?
Are you affected by CVE-2025-67349?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST