CVE-2025-67443

MediumCVSS 6.1

Published: 22/12/2025(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS). Due to lack of javascript sanitization in the login form, incorrect login attempts in logs are triggered as XSS in the admin panel.

Risk Assessment

An attacker could inject malicious JavaScript that executes in the administrator's browser when viewing logs, potentially leading to session hijacking.

Recommendation

Update Schlix CMS to version v2.2.9-5 or later, which fixes this vulnerability.

Other vulnerabilities in Schlix CMS

CVE-2021-47964High
Schlix CMS version 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious extension packages through the block manager. Attackers can upload a crafted ZIP file containing PHP code in the packageinfo.inc file and trigger execution by accessing the About tab of the installed extension.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS