Schlix CMS CVE-2025-67443

Exploitation requires two things: (1) an attacker submits an incorrect/failed login attempt at the Schlix CMS login form with a username (or login field) containing a JavaScript payload - reachable remotely without authentication because the login form does not sanitize input; and (2) a logged-in administrator must subsequently open and view the login-attempt logs in the admin panel, at which point the stored payload executes in the admin's authenticated context (this is the UI:R limiting factor). Exploitation is limited to Schlix CMS versions before v2.2.9-5; patched instances are not affected. Impact is confined to script execution in the admin's browser session (Low C/Low I), with no availability impact.

This is a moderate-severity stored/reflected XSS (CVSS 6.1) that should be treated as a routine, scheduled patch rather than an emergency. The signals are consistent and point to low real-world urgency: EPSS is 0.19% (8th percentile), the CVE is NOT listed in CISA KEV, and the vuln.today decision label is 'this_month' (not act_now/emergency). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-reachable, unauthenticated injection point, but exploitation is gated on UI:R - a privileged administrator must view the login-attempt logs in the admin panel for the payload to fire, and impact is limited to Low confidentiality/integrity with no availability effect. The scope change (S:C) reflects that attacker-controlled input submitted at the unauthenticated login form executes later in the authenticated admin-panel context. No KEV listing plus a low EPSS is coherent, not conflicting. A public reference exists (an akinerkisa gist linked from NVD) but it is a reference, not confirmed working weaponized exploit code. Net: a legitimate issue worth patching on a normal cadence, not a high-CVSS-but-overrated item nor an active-exploitation priority.

An unauthenticated attacker submits a login attempt using a crafted username containing JavaScript; because the login form lacks sanitization, the failed-attempt entry is stored and later rendered unescaped in the admin panel's logs. When an administrator reviews those login logs, the script executes in their authenticated browser session (admin-panel context), enabling session/credential theft or admin-context actions. A public PoC reference exists (gist by the reporter); it is not verified as working exploit code.