by Kastro
Paper/Archive/CVE-2025-50754

CVE-2025-50754

mitre — Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality.

EPSS 0.6%public exploitCVSS 9.6
critical.is priorityof 100
49
CVSS 9.6 (ADP)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 49.8.498 × 2010.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality. A malicious script submitted by an attacker is rendered in the admin panel when viewed by an administrator. This allows attackers to hijack the admin session and, by leveraging the template editor, upload and execute a PHP web shell on the server, leading to full remote code execution.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/furk4nyildiz/CVE-2025-50754-PoC