CVE-2025-11332
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was found in CmsEasy up to version 7.7.7 in the lib/inc/view.php library of the URL Handler component. Manipulating the PHP_SELF argument can lead to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.
Risk Assessment
A remote attacker could execute a malicious script in the user's browser, potentially leading to session or data theft. The vendor's lack of response means no official fix is available.
Recommendation
Implement validation and sanitization of the PHP_SELF argument and consider using a WAF. Monitor for available updates and consider alternative solutions if no fix is released.
Other vulnerabilities in CmsEasy
See all- CVE-2025-15148Medium
A flaw has been found in CmsEasy up to 7.7.7. Affected is the function savetemp_action in the library /lib/admin/template_admin.php of the component Backend Template Management Page. Executing a manipulation of the argument content/tempdata can lead to code injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2024-32162Medium
CMSeasy version 7.7.7.9 is vulnerable to arbitrary file deletion. An attacker can exploit this vulnerability to delete critical system files.
Original NVD description (English source)
A vulnerability was determined in CmsEasy up to 7.7.7. This affects an unknown function in the library lib/inc/view.php of the component URL Handler. Executing a manipulation of the argument PHP_SELF can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS