{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.4.2"}],"component":"juzaweb/cms","cve_ids":["CVE-2025-5420"],"ecosystem":"Packagist","epss":0.00379,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-49rr-34j5-r8mw","id":"tcs_01M5KETVD0AZ445GMHZMFTPXF1","modified_at":"2025-06-18T18:57:18.817171Z","published_at":"2025-06-02T00:30:28Z","references":["https://osv.dev/vulnerability/GHSA-49rr-34j5-r8mw","https://nvd.nist.gov/vuln/detail/CVE-2025-5420","https://github.com/Cyber-Wo0dy/report/blob/main/juzawebcms/3.4.2/juzawebcms_avatar_xss.md","https://github.com/juzaweb/cms","https://vuldb.com/?ctiid.310753","https://vuldb.com/?id.310753","https://vuldb.com/?submit.584048"],"severity":{"label":"low","score":3.5},"sources":[{"source":"osv","source_id":"GHSA-49rr-34j5-r8mw","url":"https://osv.dev/vulnerability/GHSA-49rr-34j5-r8mw"}],"summary":"juzaweb CMS allows cross-site scripting by uploading an SVG file"}