CVE-2025-13181

LowCVSS 3.5

Published: 14/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

h3blog 1.0 by pojoin has a cross-site scripting (XSS) vulnerability in /admin/cms/material/add. Manipulation of the Name argument leads to XSS. The attack can be performed remotely, and the exploit has been publicly disclosed.

Risk Assessment

An attacker could inject malicious scripts, potentially leading to data theft, session hijacking, or other attacks against system users.

Recommendation

Update h3blog to a patched version. Sanitize input in /admin/cms/material/add.

Other vulnerabilities in h3blog

CVE-2025-13182Low
h3blog 1.0 by pojoin has a cross-site scripting (XSS) vulnerability in /admin/cms/category/addtitle. Manipulation of the Title argument leads to XSS. The attack can be performed remotely, and the exploit is publicly available.

Original NVD description (English source)

A vulnerability was determined in pojoin h3blog 1.0. The affected element is an unknown function of the file /admin/cms/material/add. Executing a manipulation of the argument Name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS