CVEvulnerability

CVE-2025-66468

6.1 MEDIUM Published 2025-12-02 Modified 2026-10-18 Official page ↗
Status
Analyzed
Published
2025-12-02
Last modified
2026-10-18
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.6 HIGH — CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79

Description

The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.

Affected configurations

• aimeos grapesjs cms (>= 2021.04.1 < 2021.10.8) • aimeos grapesjs cms (>= 2022.04.1 < 2022.10.9) • aimeos grapesjs cms (>= 2023.04.1 < 2023.10.15) • aimeos grapesjs cms (>= 2024.04.1 < 2024.10.8) • aimeos grapesjs cms (>= 2025.04.1 < 2025.10.2)

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References