CVE-2025-60869

{
  "id": "CVE-2025-60869",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-10T15:16:05.710",
  "lastModified": "2026-11-05T22:10:00.203",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Publii CMS v0.46.5 (build 17089) allows persistent Cross-Site Scripting (XSS) via unsanitized input in configuration fields such as \"Site Description\" and \"Footer Follow Buttons\". An attacker can inject arbitrary JavaScript, which is stored in the project and executed in the browsers of remote visitors viewing the generated static site."
    },
    {
      "lang": "es",
      "value": "Publii CMS v0.46.5 (compilación 17089) permite cross-site scripting (XSS) persistente a través de entrada no saneada en campos de configuración como ’Descripción del Sitio’ y ’Botones de Seguir en el Pie de Página’. Un atacante puede inyectar JavaScript arbitrario, que se almacena en el proyecto y se ejecuta en los navegadores de los visitantes remotos que ven el sitio estático generado."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-10T15:05:18.879842Z",
          "id": "CVE-2025-60869",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://getpublii.com/download/",
      "source": "[email protected]"
    },
    {
      "url": "https://gist.github.com/kasiasok/63f7dcc9c453857005066ee9738318a9",
      "source": "[email protected]"
    }
  ]
}