What is the CVSS score of CVE-2025-25287?

CVE-2025-25287 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Lakeus are affected by CVE-2025-25287?

Organizations using made for MediaWiki. Starting in should be aware of moderate risk from CVE-2025-25287, a cross-site scripting vulnerability rated CVSS 4.7.

How to fix or mitigate CVE-2025-25287?

Within 30 days: Identify affected systems running made for MediaWiki. Starting in and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Lakeus CVE-2025-25287

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-02-13 security-advisories@github.com

XSS

4.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.7 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:26 vuln.today

CVE Published

Feb 13, 2025 - 16:16 nvd

MEDIUM 4.7

DescriptionGitHub Advisory

Lakeus is a simple skin made for MediaWiki. Starting in version 1.0.8 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus is vulnerable to store cross-site scripting via malicious system messages, though editing the messages requires high privileges. Those with (editinterface) rights can edit system messages that are improperly handled in order to send raw HTML. In the case of lakeus-footermessage, this will affect all users if the server is configured to link back to this repository. Otherwise, the system messages in themeDesigner.js are only used when the user enables it in their preferences. Versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0 contain a patch.

AnalysisAI

Lakeus is a simple skin made for MediaWiki. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Lakeus is a simple skin made for MediaWiki. Starting in version 1.0.8 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus is vulnerable to store cross-site scripting via malicious system messages, though editing the messages requires high privileges. Those with (editinterface) rights can edit system messages that are improperly handled in order to send raw HTML. In the case of lakeus-footermessage, this will affect all users if the server is configured to link back to this repository. Otherwise, the system messages in themeDesigner.js are only used when the user enables it in their preferences. Versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0 contain a patch. Version information: version 1.0.8.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.