CVE-2025-67443

Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS). Due to lack of javascript sanitization in the login form, incorrect login attempts in logs are triggered as XSS in the admin panel.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://gist.github.com/akinerkisa/b22f4517a4011d049c5fc7fd3b29c9f2	Third Party Advisory
https://www.schlix.com/news/release/december-2025-errata-5-bug-fix-release.html#:~:text=Fixed%20XSS%20vulnerability%20bug%20when%20clicking%20New%20User%20%28thank%20you%20to%20Ak%C4%B1ner%20K%C4%B1sa%20who%20reported%20this%20security%20bug%20and%20provided%20reasonable%20time%20to%20fix%29	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:schlix:cms:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Schlix CMS, en versiones anteriores a la 2.2.9-5, es vulnerable a Cross Site Scripting (XSS). Debido a la falta de sanitización de JavaScript en el formulario de inicio de sesión, los intentos de inicio de sesión incorrectos en los registros se desencadenan como XSS en el panel de administración.

Information

Published : 2025-12-22 17:15

Updated : 2026-10-26 22:10

NVD link : CVE-2025-67443

Mitre link : CVE-2025-67443

CVE.ORG link : CVE-2025-67443

JSON object : View

Products Affected

schlix

cms

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-67443", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67443", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-22T17:00:27.121971Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-22T17:15:59.913", "references": [{"url": "https://gist.github.com/akinerkisa/b22f4517a4011d049c5fc7fd3b29c9f2", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.schlix.com/news/release/december-2025-errata-5-bug-fix-release.html#:~:text=Fixed%20XSS%20vulnerability%20bug%20when%20clicking%20New%20User%20%28thank%20you%20to%20Ak%C4%B1ner%20K%C4%B1sa%20who%20reported%20this%20security%20bug%20and%20provided%20reasonable%20time%20to%20fix%29", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS). Due to lack of javascript sanitization in the login form, incorrect login attempts in logs are triggered as XSS in the admin panel."}, {"lang": "es", "value": "Schlix CMS, en versiones anteriores a la 2.2.9-5, es vulnerable a Cross Site Scripting (XSS). Debido a la falta de sanitizaci\u00f3n de JavaScript en el formulario de inicio de sesi\u00f3n, los intentos de inicio de sesi\u00f3n incorrectos en los registros se desencadenan como XSS en el panel de administraci\u00f3n."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schlix:cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "90243240-BE93-4144-ACBE-E4D5AB2B5396", "versionEndExcluding": "2.2.9-5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}