PT-2025-22652 · Dobrycms · Dobrycms

Kamil Szczurowski + 1 · Published 2025-05-23 · Updated 2025-05-23 · CVE-2025-4379

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions DobryCMS versions 2.* and lower

Description The issue is related to Reflected Cross-Site Scripting (XSS) due to improper input validation in the szukaj parameter. This allows arbitrary JavaScript to be executed on a victim's browser when a specially crafted URL is opened.

Recommendations For DobryCMS versions 2.* and lower, apply the hotfix released on 29.04.2025 to remove the vulnerability. As a temporary workaround, consider restricting access to the szukaj parameter to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-4379

Affected Products

Dobrycms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-4379 · Security Note
• https://cert.pl/en/posts/2025/05/CVE-2025-4379 · Note
• https://twitter.com/CVEnew/status/1925879145042440534 · Twitter Post
• https://cert.pl/posts/2025/05/CVE-2025-4379 · Note
• https://studiofabryka.pl/Systemy_CMS.html · Note
• https://t.me/cvetracker/24525 · Telegram Post
• https://t.me/cvenotify/123420 · Telegram Post