Vulnerability Description
Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the product.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Appleple | A-Blog Cms | >= 3.0.0, < 3.0.47 |
Related Weaknesses (CWE)
References
- https://developer.a-blogcms.jp/blog/news/JVNVU-90760614.htmlVendor Advisory
- https://jvn.jp/en/vu/JVNVU90760614/Third Party Advisory
FAQ
What is CVE-2025-32999?
CVE-2025-32999 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the entry editing screen, and exploitation requ...
How severe is CVE-2025-32999?
CVE-2025-32999 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-32999?
Check the references section above for vendor advisories and patch information. Affected products include: Appleple A-Blog Cms.