What is the CVSS score of EUVD-2025-18995?

EUVD-2025-18995 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Suse are affected by EUVD-2025-18995?

Organizations using application should be aware of moderate risk from CVE-2025-47943, a cross-site scripting vulnerability rated CVSS 6.3.. A patch is available.

How to fix or mitigate EUVD-2025-18995?

Within 30 days: Identify affected systems running application and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Suse EUVD-2025-18995

| CVE-2025-47943 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-24 security-advisories@github.com

GHSA-xh32-cx6c-cp4v

XSS RCE Suse

6.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

SUSE

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 22:36 euvd

EUVD-2025-18995

Analysis Generated

Mar 15, 2026 - 22:36 vuln.today

CVE Published

Jun 24, 2025 - 04:15 nvd

MEDIUM 6.3

DescriptionGitHub Advisory

Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting (XSS) vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20 under public/plugins/. This issue has been fixed for gogs.io/gogs in version 0.13.3.