CVE-2025-61183

MediumCVSS 6.1

Published: 08/10/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

23th percentile - higher than 23% of all known CVEs

Summary

Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via the upload method in the storeAvatar() method of UserBase.php. An attacker can inject malicious code.

Risk Assessment

This may lead to session hijacking, data theft, or unauthorized actions performed in the victim's browser context. Immediate update is required.

Recommendation

Update vaahcms to a version containing the fix. Additionally, implement input validation and sanitization, and consider using security headers.

Other vulnerabilities in vaahcms

CVE-2026-67595High
A vulnerability in VaahCMS versions 2.0.0-2.3.4 involves a malicious obfuscated JavaScript payload embedded in the Blade template for OTP emails. The payload establishes a WebSocket connection to a C2 server, installs a password keylogger, scrapes WhatsApp Web DOM, and accepts remote commands to redirect or overwrite the page.

Original NVD description (English source)

Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php

Vulnerability data from NVD (NIST) · CISA KEV · EPSS