CVE-2025-67349
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the application fails to properly sanitize input in the <head> section, allowing remote attackers to inject arbitrary script tags.
Risk Assessment
XSS can allow attackers to execute arbitrary JavaScript in the victim's browser, steal session cookies, or take over accounts. This can lead to full compromise of the application.
Recommendation
Update FluentCMS to the latest version if available, or apply input sanitization fixes. Implement CSP headers and server-side validation.
Other vulnerabilities in FluentCMS
See all- CVE-2026-86271Medium
Missing authorization vulnerability in FluentCMS up to 0.0.5, affecting the GetAccessible function in PermissionManager.cs. Manipulation results in missing authorization. The attack can be initiated remotely, and the exploit is public.
- CVE-2026-11434Low
A vulnerability in FluentCMS 0.0.5 in an unknown function of file /admin/blocks in the Blocks Plugin component leads to cross-site scripting (XSS). The attack can be initiated remotely. The exploit has been made public.
- CVE-2026-38947Medium
FluentCMS 1.2.3 is vulnerable to XSS in the TextHTML plugin. An attacker can inject malicious script that executes in the victim's browser.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the application fails to properly sanitize input in the <head> section, allowing remote attackers to inject arbitrary script tags.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS