CVE-2025-13182

LowCVSS 3.5

Published: 14/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

h3blog 1.0 by pojoin has a cross-site scripting (XSS) vulnerability in /admin/cms/category/addtitle. Manipulation of the Title argument leads to XSS. The attack can be performed remotely, and the exploit is publicly available.

Risk Assessment

An attacker could inject malicious scripts, potentially leading to data theft, session hijacking, or other attacks against system users.

Recommendation

Update h3blog to a patched version. Sanitize input in /admin/cms/category/addtitle.

Other vulnerabilities in h3blog

CVE-2025-13181Low
h3blog 1.0 by pojoin has a cross-site scripting (XSS) vulnerability in /admin/cms/material/add. Manipulation of the Name argument leads to XSS. The attack can be performed remotely, and the exploit has been publicly disclosed.

Original NVD description (English source)

A vulnerability was identified in pojoin h3blog 1.0. The impacted element is an unknown function of the file /admin/cms/category/addtitle. The manipulation of the argument Title leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS