How to fix EUVD-2025-18488?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Is Mezzanine affected by EUVD-2025-18488?

Organizations using versions should be aware of moderate risk from CVE-2025-6050, a cross-site scripting vulnerability rated CVSS 4.8. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Proof-of-concept code is publicly available.

Mezzanine EUVD-2025-18488

| CVE-2025-6050 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-17 596c5446-0ce5-4ba2-aa66-48b3b757a647

GHSA-7pr5-w74r-jjj7

XSS Mezzanine

4.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18488

Patch released

Mar 14, 2026 - 22:15 nvd

Patch available

PoC Detected

Jul 30, 2025 - 19:09 vuln.today

Public exploit code

CVE Published

Jun 17, 2025 - 11:15 nvd

MEDIUM 4.8

DescriptionNVD

Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_links.js" endpoint, causing the malicious script to execute in their browser.

Analysis

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

A vendor patch is available — apply it immediately. Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.

EUVD-2025-18488 vulnerability details – vuln.today

Back