PT-2025-44216 · Laravel+1 · Laravel+1

Published 2025-10-28 · Updated 2025-10-29 · CVE-2025-62798

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sharp versions prior to 9.11.1

Description Sharp, a content management framework for Laravel, contains a Cross-Site Scripting (XSS) issue in the SharpShowTextField component. Prior to version 9.11.1, expressions enclosed in {{ & }} were processed by Vue, enabling attackers to inject malicious JavaScript or HTML code. This injected code executes within the user's browser when the affected field is displayed. The vulnerability arises from improper handling of expressions during content rendering.

Recommendations Update to version 9.11.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62798

GHSA-9F58-4465-23C7

Affected Products

Laravel

Sharp

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62798.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62798 · Security Note
• https://osv.dev/vulnerability/GHSA-9f58-4465-23c7 · Vendor Advisory
• https://github.com/code16/sharp/releases/tag/v9.11.1 · Note
• https://github.com/code16/sharp/pull/654 · Note
• https://github.com/code16/sharp/security/advisories/GHSA-9f58-4465-23c7 · Note
• https://github.com/code16/sharp · Note
• https://github.com/ViktorMares/vue-js-xss-payload-list · Note
• https://reddit.com/r/VulnMatter/comments/1oj4i5j/resumen_diario_de_vulnerabilidades_29102025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1983387079561117778 · Twitter Post
• https://twitter.com/CVEnew/status/1983285462807760899 · Twitter Post
• https://t.me/CVEtracker/36005 · Telegram Post
• https://medium.com/@sid0krypt/vue-js-reflected-xss-fae04c9872d2 · Note