Read the docs
TI-2025-40916 Aliases CVE-2025-66492

Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter

Priority LOW 35CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 through 7.5.1 are vulnerable to XSS when an unsanitized value of the ajax URL query parameter is directly included within the <head> section of the HTML page. An attacker can execute arbitrary scripts in the context of the user's session, potentially leading to Session Hijacking, Data Theft, Defacement and Malware Distribution. This issue is fixed in versions 7.5.2, 7.4.9, 7.3.14, and 7.2.9. To work around this issue, configure a Web Application Firewall (WAF) rule (e.g., ModSecurity) to block requests containing common XSS payload characters in the ajax query parameter. Alternatively, implement server-side sanitization using middleware to strip or escape dangerous characters from the ajax parameter before it reaches the vulnerable rendering logic.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0025 16th percentileScored 2026-11-07
Fix Fixed MasaCMS (MasaCMS): 7.2.9, 7.3.14, 7.4.8 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MasaCMSMasaCMSbefore 7.2.9; 7.3.1 to before 7.3.14; 7.4.0-alpha.1 to before 7.4.8; 7.5.0 to before 7.5.27.2.9, 7.3.14, 7.4.8, 7.5.2Patch availableCNA
  • MasaCMS VendorMasaCMS Affected before 7.2.9; 7.3.1 to before 7.3.14; 7.4.0-alpha.1 to before 7.4.8; 7.5.0 to before 7.5.2 Fixed in 7.2.9, 7.3.14, 7.4.8, 7.5.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:*before 7.2.9; 7.3.1 to before 7.3.14; 7.4.0 to before 7.4.9; 7.5.0 to before 7.5.2VulnerableMasaCMS
  • cpe:2.3:a:masacms:masacms:*:*:*:*:*:*:*:* Versions before 7.2.9; 7.3.1 to before 7.3.14; 7.4.0 to before 7.4.9; 7.5.0 to before 7.5.2 Vulnerable ·MasaCMS

Remediation

  • Fix · CNA MasaCMS (MasaCMS) Fixed in 7.2.9, 7.3.14, 7.4.8, 7.5.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66492

References

Patch 2

  • TI-2024-21523 Masa CMS Vulnerable to Pre-Auth RCE via JSON API CVSS 3.1CRITICAL 9.8
  • TI-2024-21524 Host header poisoning allows account takeover via password reset email CVSS 3.1HIGH 8.8
  • TI-2024-21525 Masa CMS vulnerable to authentication bypass with /tag/ CVSS 3.1HIGH 7.5
  • TI-2022-23274 A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows… CVSS 3.1CRITICAL 9.8
  • TI-2021-18659 MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/. CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences