BaseFortify

Publication date: 2026-02-02

Last updated on: 2026-02-11

Assigner: MITRE

Description

Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the dbuser, dbpwd, and dbname parameters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-02

Last Modified

2026-02-11

Generated

2026-07-06

AI Q&A

2026-02-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-70958

Affected Vendors & Products

Vendor	Product	Version / Range
intelliants	subrion_cms	4.2.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a set of multiple reflected cross-site scripting (XSS) issues in the installation module of Subrion CMS version 4.2.1. Attackers can inject malicious JavaScript code by crafting payloads in the dbuser, dbpwd, and dbname parameters, which then execute in the context of the user's browser.

Impact Analysis

The vulnerability allows attackers to execute arbitrary JavaScript in the user's browser, which can lead to session hijacking, theft of sensitive information, defacement of the website, or redirection to malicious sites, potentially compromising user security and trust.

Hi! I’m here to help you understand CVE-2025-70958. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70