Reflected XSS in RiteCMS 3.1.0 Enables Browser Code Execution

Publication date: 2025-12-17

Last updated on: 2025-12-18

Assigner: MITRE

Description

A reflected cross-site scripting (XSS) vulnerability in RiteCMS v3.1.0 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-17

Last Modified

2025-12-18

Generated

2026-07-06

AI Q&A

2025-12-17

EPSS Evaluated

2026-07-05

NVD

CVE-2025-67170

EUVD

EUVD-2025-203914

Affected Vendors & Products

Vendor	Product	Version / Range
ritecms	ritecms	3.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a reflected cross-site scripting (XSS) issue in RiteCMS version 3.1.0. It allows attackers to inject and execute arbitrary code within the browser of a user who clicks on a specially crafted link or payload. This means the attacker can run malicious scripts in the context of the victim's browser session.

Impact Analysis

The vulnerability can lead to unauthorized execution of malicious scripts in users' browsers, potentially resulting in theft of session cookies, user credentials, or other sensitive information. It may also allow attackers to perform actions on behalf of the user or redirect them to malicious sites, compromising user security and trust.

Hi! I’m here to help you understand CVE-2025-67170. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70