MCMS CVE-2025-60837

The attack requires the victim to load a crafted URL - specifically, the attacker must deliver the malicious link to the target and induce them to click it (CVSS UI:R). No authentication or privileges are required on the attacker's part (PR:N). The attacker must have network access to the MCMS instance or craft a URL pointing to a publicly accessible deployment. Exploitation is limited by: (1) mandatory user interaction with the crafted link, preventing automated/wormable exploitation; (2) the impact ceiling is bounded by the victim's session privileges - a low-privilege user session yields only low-privilege JavaScript execution context; (3) MCMS being a niche CMS limits the available target population. No special server-side configuration beyond a running MCMS v6.0.1 instance is required.

The CVSS 3.1 base score of 6.1 (Medium) is driven by AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The attack requires no attacker-side authentication and is low-complexity, but mandates user interaction (UI:R) - the victim must click or load the crafted URL - which is the primary limiting factor against mass exploitation. EPSS of 0.22% at the 13th percentile indicates the broader security community currently treats this as low-priority relative to all CVEs, and no CISA KEV listing is present. A GitHub gist is referenced (https://gist.github.com/xuzhiwei66666666/5cec37c9f674a08bc0d8654d42b4137a) and likely contains a PoC or reproduction steps, though its exact contents are not confirmed from the provided data - this should not be conflated with active in-the-wild exploitation. Real-world priority is low for most organizations; the primary escalation scenario would be a targeted phishing attack against an MCMS administrator, where session cookie theft could yield full application compromise.

An attacker identifies the vulnerable parameter in MCMS v6.0.1 that reflects unsanitized input, then constructs a URL embedding a JavaScript payload (e.g., a cookie-stealing script). The attacker delivers this URL to an MCMS administrator via a phishing email; when the administrator clicks the link and the page loads in their browser, the payload executes, exfiltrating the session cookie to an attacker-controlled server and granting full authenticated access to the CMS. A GitHub gist referenced in NVD likely documents the precise parameter and payload required.