Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter

8.2 / 10

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Description

Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 through 7.5.1 are vulnerable to XSS when an unsanitized value of the ajax URL query parameter is directly included within the <head> section of the HTML page. An attacker can execute arbitrary scripts in the context of the user's session, potentially leading to Session Hijacking, Data Theft, Defacement and Malware Distribution. This issue is fixed in versions 7.5.2, 7.4.9, 7.3.14, and 7.2.9. To work around this issue, configure a Web Application Firewall (WAF) rule (e.g., ModSecurity) to block requests containing common XSS payload characters in the ajax query parameter. Alternatively, implement server-side sanitization using middleware to strip or escape dangerous characters from the ajax parameter before it reaches the vulnerable rendering logic.

Basic Information

ID CVE-2025-66492

Source GitHub_M

Published Dec 12, 2025 at 04:50

Affected Product

Vendor MasaCMS

Product MasaCMS

Version < 7.2.9

Affected Versions MasaCMS MasaCMS < 7.2.9
MasaCMS MasaCMS >= 7.3.1, < 7.3.14
MasaCMS MasaCMS >= 7.4.0-alpha.1, < 7.4.8
MasaCMS MasaCMS >= 7.5.0, < 7.5.2

CWE Classification

CWE-79

References

{
    "lastseen": "",
    "description": "Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 through 7.5.1 are vulnerable to XSS when an unsanitized value of the ajax URL query parameter is directly included within the <head> section of the HTML page. An attacker can execute arbitrary scripts in the context of the user's session, potentially leading to Session Hijacking, Data Theft, Defacement and Malware Distribution. This issue is fixed in versions 7.5.2, 7.4.9, 7.3.14, and 7.2.9. To work around this issue, configure a Web Application Firewall (WAF) rule (e.g., ModSecurity) to block requests containing common XSS payload characters in the ajax query parameter. Alternatively, implement server-side sanitization using middleware to strip or escape dangerous characters from the ajax parameter before it reaches the vulnerable rendering logic.",
    "published": "2025-12-12T04:50:00.637Z",
    "modified": "2025-12-12T04:50:00.637Z",
    "type": "cve",
    "title": "Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter",
    "source": "GitHub_M",
    "references": "https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-249c-vqwv-43vc\nhttps://github.com/MasaCMS/MasaCMS/commit/376c27196b1e2489888b7a000cdf5c45bb85959e",
    "id": "CVE-2025-66492",
    "bulletinFamily": "",
    "cwe": [
        "CWE-79"
    ],
    "cvelist": null,
    "sourceData": "MasaCMS MasaCMS < 7.2.9\nMasaCMS MasaCMS >= 7.3.1, < 7.3.14\nMasaCMS MasaCMS >= 7.4.0-alpha.1, < 7.4.8\nMasaCMS MasaCMS >= 7.5.0, < 7.5.2",
    "sourceHref": "",
    "cvss": {
        "score": 8.2,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "MasaCMS",
    "version": "< 7.2.9",
    "vendor": "MasaCMS",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}

Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter_CVE-2025-66492