SiberianCMS HTTP GET Request flat cross site scripting
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting, Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.
Summary
A vulnerability was found in SiberianCMS 4.20.6. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /app/sae/design/desktop/flat of the component HTTP GET Request Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | SiberianCMS | 4.20.6 | — | No fix listed | CNA |
- SiberianCMS Vendor— Affected 4.20.6 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siberiancms:siberiancms:4.20.6:*:*:*:*:*:*:* | 4.20.6 | Vulnerable | SiberianCMS |
- cpe:2.3:a:siberiancms:siberiancms:4.20.6:*:*:*:*:*:*:* Versions 4.20.6 Vulnerable ·SiberianCMS
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-1105
- 2026-10-03 Alias added: GHSA-c7v2-cqjq-g6rr
References
—
More Siberiancms vulnerabilities
- TI-2024-27762 SiberianCMS – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVSS 3.1CRITICAL 9.8
- TI-2023-20514 SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges CVSS 3.1CRITICAL 9.8
- TI-2023-20517 SQL injection in SiberianCMS CVSS 3.1HIGH 8.8
- TI-2023-20516 Unrestricted file upload in SiberianCMS CVSS 3.1HIGH 7.2
- TI-2023-20515 SiberianCMS - CWE-284: Improper Access Control Authorized user may disable a security feature over the network CVSS 3.1MEDIUM 6.5
- TI-2017-04632 An issue was discovered in SiberianCMS before 4.10.0. CVSS 3.0MEDIUM 6.1
Sources
- CVE-2025-1105 · CVE Program
- CVE-2025-1105 · NVD
- FIRST EPSS
- GHSA-c7v2-cqjq-g6rr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences