CVE-2025-66686

A stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2. An authenticated attacker with administrative privileges can inject malicious JavaScript code into the “Help button url” setting within the admin panel. The injected payload is stored and executed when any authenticated user clicks the Help button, potentially leading to session hijacking, information disclosure, privilege escalation, and unauthorized administrative actions.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/mertdurum06/Perch-v3.2	Exploit
https://github.com/mertdurum06/Perch-v3.2/blob/main/Perch%20v3.2_Poc.txt	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:grabaperch:perch:3.2:*:*:*:*:*:*:*

History

04 Nov 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de Cross-Site Scripting (XSS) almacenada en Perch CMS versión 3.2. Un atacante autenticado con privilegios administrativos puede inyectar código JavaScript malicioso en la configuración ’Help button url’ dentro del panel de administración. La carga útil inyectada es almacenada y ejecutada cuando cualquier usuario autenticado hace clic en el botón de Ayuda, lo que podría llevar a secuestro de sesión, revelación de información, escalada de privilegios y acciones administrativas no autorizadas.

Information

Published : 2026-01-07 17:16

Updated : 2026-11-04 22:10

NVD link : CVE-2025-66686

Mitre link : CVE-2025-66686

CVE.ORG link : CVE-2025-66686

JSON object : View

Products Affected

grabaperch

perch

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-66686", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66686", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T17:08:20.628444Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-01-07T17:16:01.117", "references": [{"url": "https://github.com/mertdurum06/Perch-v3.2", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://github.com/mertdurum06/Perch-v3.2/blob/main/Perch%20v3.2_Poc.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2. An authenticated attacker with administrative privileges can inject malicious JavaScript code into the \u201cHelp button url\u201d setting within the admin panel. The injected payload is stored and executed when any authenticated user clicks the Help button, potentially leading to session hijacking, information disclosure, privilege escalation, and unauthorized administrative actions."}, {"lang": "es", "value": "Existe una vulnerabilidad de Cross-Site Scripting (XSS) almacenada en Perch CMS versi\u00f3n 3.2. Un atacante autenticado con privilegios administrativos puede inyectar c\u00f3digo JavaScript malicioso en la configuraci\u00f3n \u2019Help button url\u2019 dentro del panel de administraci\u00f3n. La carga \u00fatil inyectada es almacenada y ejecutada cuando cualquier usuario autenticado hace clic en el bot\u00f3n de Ayuda, lo que podr\u00eda llevar a secuestro de sesi\u00f3n, revelaci\u00f3n de informaci\u00f3n, escalada de privilegios y acciones administrativas no autorizadas."}], "lastModified": "2026-11-04T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:grabaperch:perch:3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "914354F9-2440-4FC0-BECC-C3A08FFDB6EF"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}