CVE-2025-60859

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-23

Last updated on: 2025-10-28

Assigner: MITRE

Description

Cross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via crafted c_id parameter in bbs/view_comment.php.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-23

Last Modified

2025-10-28

Generated

2026-07-06

AI Q&A

2025-10-23

EPSS Evaluated

2026-07-05

NVD

CVE-2025-60859

EUVD

EUVD-2025-35714

Affected Vendors & Products

Vendor	Product	Version / Range
sir	gnuboard	5.6.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross Site Scripting (XSS) issue in Gnuboard version 5.6.15. It allows authenticated attackers to execute arbitrary code by exploiting a crafted 'c_id' parameter in the file bbs/view_comment.php.

Impact Analysis

An attacker who is authenticated can exploit this vulnerability to execute arbitrary code within the context of the affected application. This can lead to unauthorized actions, data theft, session hijacking, or other malicious activities depending on the attacker's intent.

Mitigation Strategies

Apply the patch that fixes the XSS vulnerability in Gnuboard 5.6.15 by updating to the fixed version or applying the commit available at https://github.com/gnuboard/gnuboard5/commit/002e43e5fb84b465357b445772c881e196e100d3. [1]

Hi! I’m here to help you understand CVE-2025-60859. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70