CVE-2025-67549

MediumCVSS 6.5

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

oik up to version 4.15.3 contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to execute malicious scripts in the victim's browser.

Risk Assessment

An attacker can hijack user sessions, steal data, or perform unauthorized actions in the victim's context, potentially leading to confidentiality and integrity breaches.

Recommendation

Update oik to the latest version that includes a fix for this vulnerability. Additionally, consider implementing Content Security Policy (CSP) to mitigate XSS risks.

Other vulnerabilities in oik

CVE-2026-96819High
oik plugin in versions up to and including 4.15.4 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik oik allows DOM-Based XSS.This issue affects oik: from n/a through <= 4.15.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS