CVE-2025-14244

LowCVSS 2.4

Published: 08/12/2025(UTC)Updated: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

A cross-site scripting vulnerability was found in GreenCMS 2.3.0603 within the Menu Management Page functionality, in the file /Admin/Controller/CustomController.class.php. Manipulation of the Link argument allows script injection, and the attack can be initiated remotely. The exploit has been published and may be used.

Risk Assessment

A remote attacker could execute malicious script in an administrator's browser, potentially leading to session theft or account takeover. The product is no longer supported by the maintainer, so no patches should be expected.

Recommendation

Discontinue use of GreenCMS 2.3.0603 and migrate to an actively maintained CMS. If that is not possible, isolate the application from the internet and implement additional input filtering.

Other vulnerabilities in GreenCMS

CVE-2025-15187Low
A vulnerability was found in GreenCMS up to version 2.3 in the file /DataController.class.php of the File Handler component. Manipulation of the sqlFiles/zipFiles arguments leads to path traversal. The attack can be initiated remotely and the exploit has been made public.

Original NVD description (English source)

A flaw has been found in GreenCMS 2.3.0603. Affected by this issue is some unknown functionality of the file /Admin/Controller/CustomController.class.php of the component Menu Management Page. This manipulation of the argument Link causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS