by Kastro
Paper/Archive/CVE-2025-67906

CVE-2025-67906

MISP MISP — In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.

EPSS 0.3%public exploitCVSS 9.0
critical.is priorityof 100
42
CVSS 9.0 (NVD)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 26.0.260 × 205.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.

Affected

ProductAffectedFixed inSource
MISP< 2.5.282.5.28CNA

Scores by source

NVD9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
mitre (CNA)5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/MISP/MISP/commit/1f39deb572da7ecb5855e30ff3cc8cbcaa0c1054refvulnerability.circl.lu/vuln/gcve-1-2025-0031refgithub.com/franckferman/GCVE-1-2025-0030refgithub.com/MISP/MISP/compare/v2.5.27...v2.5.28exploitgithub.com/franckferman/CVE-2025-67906