CVE-2025-71165
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Typesetter CMS versions up to and including 5.1 contain a reflected XSS vulnerability in the administrative interface within the Tools Status functionality. The path parameter is reflected into the HTML response without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.
Risk Assessment
The risk involves potential execution of arbitrary JavaScript in an administrator's session, which could lead to session theft, content modification, or privilege escalation within the CMS.
Recommendation
It is recommended to immediately upgrade Typesetter CMS to a version above 5.1 or apply a security patch that implements proper output encoding for the path parameter.
Original NVD description (English source)
Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status functionality. The path parameter is reflected into the HTML response without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.