UpHeron
All vulnerabilities

Servers and applications

CVE-2025-30148

XSS vulnerability in HTML editor

Severity
Medium 5.4
Published
10 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
5.3.23
Also known as
GHSA-rhx4-hvx9-j387
Sources
NVD, Project advisories (GitHub)

Description

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitized on the client-side, but server-side sanitization doesn't catch it. The…

Affected software

SoftwareAffected versions
Silverstripe CMSServers and applications · cpe:a:silverstripe:framework
  • Every version up to 5.3.23
Silverstripe CMSServers and applications · github:silverstripe/silverstripe-framework
  • Every version before 5.3.23

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-30148
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-30148
  • GitHub Advisory Database https://github.com/advisories/GHSA-rhx4-hvx9-j387
  • github.com https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-rhx4-hvx9-j387