CVE-2025-71166
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Typesetter CMS versions up to and including 5.1 contain a reflected XSS vulnerability in the administrative interface within the Tools Status move message handling. The path parameter is reflected into the HTML output without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.
Risk Assessment
The risk involves potential session hijacking, data theft, or unauthorized actions performed under an administrator's context, compromising the integrity and confidentiality of the CMS system.
Recommendation
It is recommended to immediately upgrade Typesetter CMS to a version newer than 5.1 if available, or apply a temporary workaround by manually adding output encoding for the path parameter in Status.php.
Original NVD description (English source)
Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status move message handling. The path parameter is reflected into the HTML output without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.