CVE-2025-66686
BaseFortify
Publication date: 2026-01-07
Last updated on: 2026-01-08
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mertdurum06 | perch | 3.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored Cross-Site Scripting (XSS) issue in Perch CMS version 3.2. An attacker who is authenticated and has administrative privileges can inject malicious JavaScript code into the 'Help button url' setting in the admin panel. This malicious code is then stored and executed whenever any authenticated user clicks the Help button, potentially compromising their session and security.
How can this vulnerability impact me? :
The vulnerability can lead to session hijacking, information disclosure, privilege escalation, and unauthorized administrative actions. This means attackers can steal user sessions, access sensitive information, gain higher privileges, or perform actions without authorization, compromising the security and integrity of the system and its users.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves checking the 'Help button url' setting in the Perch CMS admin panel for any injected JavaScript code. Since the vulnerability is stored XSS triggered when authenticated users click the Help button, you can audit the database or configuration files for suspicious script tags or JavaScript payloads in this setting. Specific commands are not provided in the resources, but inspecting the relevant database entries or configuration files for the 'Help button url' field for suspicious content is recommended. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting administrative access to trusted users only, reviewing and sanitizing the 'Help button url' setting to remove any injected scripts, and applying any available patches or updates to Perch CMS once released. Additionally, educating users to avoid clicking the Help button until the issue is resolved can reduce risk. [2]