CVE-2025-5420
1 advisory.
Packagist/juzaweb/cms CVE-2025-5420: low 3.5, EPSS 0.35%
juzaweb CMS allows cross-site scripting by uploading an SVG file
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.4.2 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-49rr-34j5-r8mw
- https://nvd.nist.gov/vuln/detail/CVE-2025-5420
- https://github.com/Cyber-Wo0dy/report/blob/main/juzawebcms/3.4.2/juzawebcms_avatar_xss.md
- https://github.com/juzaweb/cms
- https://vuldb.com/?ctiid.310753
- https://vuldb.com/?id.310753
- https://vuldb.com/?submit.584048
CVE-2025-5420 · published · modified · JSON