How to fix CVE-2025-14244?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

Is PHP affected by CVE-2025-14244?

CVE-2025-14244 is a low-severity vulnerability in A flaw involving cross-site scripting (CVSS 2.4). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.

CVE-2025-14244

EUVD-2025-201704 LOW

2025-12-08 [email protected]

PHP XSS

2.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 15, 2026 - 17:54 vuln.today

EUVD ID Assigned

Mar 15, 2026 - 17:54 euvd

EUVD-2025-201704

PoC Detected

Dec 23, 2025 - 00:01 vuln.today

Public exploit code

CVE Published

Dec 08, 2025 - 12:16 nvd

LOW 2.4

DescriptionNVD

A flaw has been found in GreenCMS 2.3.0603. Affected by this issue is some unknown functionality of the file /Admin/Controller/CustomController.class.php of the component Menu Management Page. This manipulation of the argument Link causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.

CVE-2025-14244 vulnerability details – vuln.today

Back