PT-2025-31063 · Vox Media · Horus Cms

Published 2025-07-28 · Updated 2025-07-28 · CVE-2025-40730

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Vox Media Chorus CMS (affected versions not specified)

Description An HTML injection issue exists in Vox Media’s Chorus CMS. An attacker can execute JavaScript code in a victim’s browser by sending a malicious URL utilizing the q parameter in the /search endpoint. This can lead to the theft of sensitive user data, such as session cookies, or actions performed on behalf of the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-40730

Affected Products

Horus Cms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-40730 · Security Note
• https://twitter.com/CVEnew/status/1949784498603798810 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1949795913288884471 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/html-injection-vox-medias-chorus-cms · Note