PT-2025-41568 · Unknown · Publii Cms

Kasiasok · Published 2025-10-10 · Updated 2025-10-10 · CVE-2025-60869

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AC:L/AV:N/A:N/C:H/I:H/PR:L/S:U/UI:R

Name of the Vulnerable Software and Affected Versions Publii CMS version 0.46.5 (build 17089)

Description Publii CMS version 0.46.5 (build 17089) contains a persistent Cross-Site Scripting (XSS) flaw. This occurs because input in configuration fields, such as “Site Description” and “Footer Follow Buttons”, is not properly sanitized. An attacker can inject arbitrary JavaScript code into these fields. This code is stored within the project and executed in the browsers of visitors accessing the generated static site. The vulnerable configuration fields include “Site Description” and “Footer Follow Buttons”.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-60869

Affected Products

Publii Cms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-60869 · Security Note
• https://getpublii.com/download · Note
• https://twitter.com/CveTodo/status/1976671571411403141 · Twitter Post
• https://t.me/CVEtracker/34595 · Telegram Post
• https://twitter.com/CVEnew/status/1976667958715015385 · Twitter Post
• https://gist.github.com/kasiasok/63f7dcc9c453857005066ee9738318a9 · Note