PT-2025-10640 · Tianti · Tianti

Kagty1O · Published 2025-03-10 · Updated 2025-06-23 · CVE-2025-25908

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions tianti version 2.3

Description A stored cross-site scripting issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the coverImageURL parameter at the "/article/ajax/save" API endpoint.

Recommendations For version 2.3, avoid using the coverImageURL parameter in the affected API endpoint until the issue is resolved. Consider implementing input validation and sanitization for the coverImageURL parameter to prevent malicious payload injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-25908

Affected Products

Tianti

References · 9

• 🔥 https://github.com/xujeff/tianti/issues/40 · Exploit
• https://osv.dev/vulnerability/CVE-2025-25908 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25908 · Security Note
• https://t.me/cvetracker/18855 · Telegram Post
• https://t.me/cvenotify/114129 · Telegram Post
• https://twitter.com/dailycve/status/1937273093246058568 · Twitter Post
• https://t.me/cvenotify/114161 · Telegram Post
• https://twitter.com/CVEnew/status/1899210954887311506 · Twitter Post
• https://t.me/cvedetector/20004 · Telegram Post