Htmly EUVD-2025-32612

| CVE-2025-56154 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-10-02 cve@mitre.org

6.1

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

3

EUVD ID Assigned

Mar 13, 2026 - 19:12 euvd

EUVD-2025-32612

Analysis Generated

Mar 13, 2026 - 19:12 vuln.today

CVE Published

Oct 02, 2025 - 16:15 nvd

MEDIUM 6.1

DescriptionCVE.org

htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The name parameter is not properly sanitized before being reflected in the HTML response, allowing attackers to inject arbitrary JavaScript payloads.

Analysis

htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The name parameter is not properly sanitized before being reflected in the HTML response, allowing attackers to inject arbitrary JavaScript payloads.

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.

More in Htmly

View all

CVE-2021-36701 CRITICAL Act Now POC

In htmly version 2.8.1, is vulnerable to an Arbitrary File Deletion on the local host when delete backup files. Rated cr

CVE-2026-45233 HIGH This Week POC

Arbitrary file relocation in HTMLy CMS through version 3.1.1 allows low-privileged authenticated users to move any web-s

CVE-2024-30953 MEDIUM This Month POC

A stored cross-site scripting (XSS) vulnerability in Htmly v2.9.5 allows attackers to execute arbitrary web scripts or H

CVE-2021-36703 MEDIUM This Month POC

The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scrip

CVE-2021-36702 MEDIUM This Month POC

The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage

CVE-2019-8349 MEDIUM This Month POC

Multiple cross-site scripting (XSS) vulnerabilities in HTMLy 2.7.4 allow remote attackers to inject arbitrary web script

CVE-2022-25022 MEDIUM This Month POC

A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a c

CVE-2022-1087 MEDIUM This Month POC

A vulnerability, which was classified as problematic, has been found in htmly 5.3 whis affects the component Edit Profil

CVE-2021-30637 MEDIUM This Month POC

htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php. Rated medium severity (CVS

CVE-2024-34191 MEDIUM This Month

htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the delete_post() function at admin.

CVE-2026-57940 LOW Monitor

Server-Side Request Forgery in HTMLy 3.1.1 allows authenticated administrators to coerce the server into issuing arbitra

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all

CVE-2013-7389 MEDIUM POC

CVE-2021-25299 MEDIUM POC

CVE-2014-2120 MEDIUM

CVE-2023-40000 HIGH POC

CVE-2016-8581 MEDIUM POC

CVE-2013-5223 MEDIUM POC

CVE-2025-52367 MEDIUM POC

CVE-2015-0072 MEDIUM POC

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

CVE-2013-1710 CRITICAL POC

CVE-2013-7389 MEDIUM POC

CVE-2021-25299 MEDIUM POC

CVE-2014-2120 MEDIUM

CVE-2023-40000 HIGH POC

CVE-2024-52875 HIGH POC

CVE-2016-8581 MEDIUM POC

Share

EUVD-2025-32612 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy