CVE-2025-62499
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-23

Last updated on: 2025-10-27

Assigner: JPCERT/CC

Description
Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of ContentType page.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-23
Last Modified
2025-10-27
Generated
2026-06-16
AI Q&A
2025-10-23
EPSS Evaluated
2026-06-15
NVD
CVE-2025-62499
EUVD
EUVD-2025-35655
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
movable_type movable_type *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in the Movable Type software, specifically in the Edit CategorySet of the ContentType page. An attacker with 'ContentType Management' privileges can store malicious script input, which will then execute in the web browser of any user who accesses that page.

Impact Analysis

The vulnerability can lead to arbitrary script execution in the browsers of users who visit the affected page, potentially allowing attackers to steal session tokens, perform actions on behalf of users, or compromise user data. However, exploitation requires the attacker to have 'ContentType Management' privileges and user interaction to trigger the script.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-62499. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart