PT-2025-21218 · Unknown · A-Blog Cms

Dinh Viet Hai + 1 · Published 2025-05-14 · Updated 2025-09-30 · CVE-2025-32999

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: a-blog cms versions prior to 3.1.43 a-blog cms versions prior to 3.0.47

Description: A cross-site scripting issue exists in a specific field in the entry editing screen of a-blog cms, requiring contributor or higher level privileges to exploit. If exploited, an arbitrary script may be executed on the web browser of the user logging in to the product.

Recommendations: For versions prior to 3.1.43, update to version 3.1.43 or later. For versions prior to 3.0.47, update to version 3.0.47 or later. As a temporary workaround, consider restricting access to the entry editing screen to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-32999

Affected Products

A-Blog Cms

References · 10

• https://developer.a-blogcms.jp/blog/news/JVNVU-90760614.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32999 · Security Note
• https://twitter.com/CVEnew/status/1924380150692565102 · Twitter Post
• https://jvn.jp/en/vu/JVNVU90760614 · Note
• https://t.me/cveNotify/136994 · Telegram Post
• https://t.me/cvetracker/24218 · Telegram Post
• https://t.me/cvenotify/122872 · Telegram Post
• https://twitter.com/syedaquib77/status/1922689214468194356 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1924441559899992487 · Twitter Post