Simple-PHP-Blog
CVE-2025-15223
LOW
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS requiring victim interaction (UI:R) with scope change to browser; low confidentiality and integrity impact, no availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in Philipinho Simple-PHP-Blog up to 94b5d3e57308bce5dfbc44c3edafa9811893d958. Impacted is an unknown function of the file /login.php. Performing manipulation of the argument Username results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure and makes clear that the product is "[f]or educational purposes only".
AnalysisAI
Cross-site scripting in Philipinho's Simple-PHP-Blog allows remote unauthenticated attackers to inject malicious JavaScript via the Username parameter on /login.php, executing arbitrary script in a victim's browser upon interaction with a crafted request. All commits up to 94b5d3e57308bce5dfbc44c3edafa9811893d958 are affected, with no fixed version available due to a rolling release model. A public proof-of-concept exploit exists (EPSS: 0.01%, 3rd percentile), though real-world impact is substantially limited by the vendor's own characterization of the product as intended for educational purposes only.
Technical ContextAI
Simple-PHP-Blog is a PHP-based blog application developed by Philipinho, identified by CPE cpe:2.3:a:philipinho:simple-php-blog:*:*:*:*:*:*:*:*, indicating all versions are affected with no version ceiling specified. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), a failure to sanitize or encode user-supplied input before reflecting it into HTML output. Specifically, the Username parameter accepted by /login.php is not properly neutralized, allowing injected script tags or event handlers to be rendered by the victim's browser. This is a classic reflected XSS pattern common in PHP applications that lack output encoding libraries or input validation routines on authentication endpoints.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project's rolling release model means no fixed version tag exists, and the vendor's 'educational purposes only' designation suggests active remediation is unlikely. Operators who have deployed this software in any public-facing context should sanitize and HTML-encode all user-supplied input before outputting it in HTTP responses, particularly the Username field in /login.php, using PHP functions such as htmlspecialchars() with ENT_QUOTES. A web application firewall (WAF) rule blocking common XSS payloads in the Username parameter can serve as a compensating control, though it introduces maintenance overhead and can be bypassed by encoding variations. The most effective remediation given the educational nature of the product is to avoid public deployment entirely, restricting any running instance to localhost or a private network. References: https://vuldb.com/?id.338608, https://gitee.com/sun-huizhi/dazhi/issues/IDBUOY.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today