CVE-2022-25585

33th percentile - higher than 33% of all known CVEs

Unioncms version 1.0.13 contains a stored XSS vulnerability in the Default settings. An attacker can inject a malicious script that will be executed in the administrator's browser.

The risk involves potential session hijacking, data theft, or content modification by executing a malicious script within the admin panel context.

Immediately update Unioncms to the latest version and apply input filtering and encoding in the Default settings.