CVE-2025-71164

Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component. The images parameter (submitted as images[] in a POST request) is reflected into an HTML href attribute without proper context-aware output encoding in include/tool/Editing.php. An authenticated attacker with editing privileges can supply a JavaScript pseudo-protocol (e.g., javascript:) to trigger arbitrary JavaScript execution in the context of the victim's browser session.

• CWE-79

• https://github.com/Typesetter/TypesetterProduct
• https://github.com/Typesetter/Typesetter/issues/706Exploit, Issue Tracking
• https://www.vulncheck.com/advisories/typesetter-cms-reflected-xss-via-editing-phpThird Party Advisory

Published

Jan 14, 2026

Last Modified

Jul 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-71159In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-7116A vulnerability classified as critical has been found in UTT…7.5
• CVE-2025-71160In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-71161In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-71162In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-71163In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-71165Typesetter CMS versions up to and including 5.1 contain a re…5.4
• CVE-2025-71166Typesetter CMS versions up to and including 5.1 contain a re…5.4
• CVE-2025-7117A vulnerability classified as critical was found in UTT HiPE…8.8
• CVE-2025-71176pytest through 9.0.2 on UNIX relies on directories with the …6.8
• CVE-2025-71177LavaLite CMS versions up to and including 10.1.0 contain a s…5.4
• CVE-2025-71178Crucial Storage Executive installer versions prior to 11.08.…7.1