{"id":"CVE-2025-4379","state":"PUBLISHED","title":"Reflected XSS in DobryCMS","description":"DobryCMS in versions 2.* and lower is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in szukaj parameter allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened.\n\nA hotfix for affected versions was released on 29.04.2025. It removes the vulnerability without incrementing the version.","publishedAt":"2025-05-23T10:00:10.396Z","updatedAt":"2025-05-23T12:13:45.256Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","source":"CERT-PL"},"assigner":"CERT-PL","products":["Studio Fabryka DobryCMS"],"affected":[{"vendor":"Studio Fabryka","product":"DobryCMS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.*","versionType":"semver"}]}],"references":["https://cert.pl/posts/2025/05/CVE-2025-4379","https://cert.pl/en/posts/2025/05/CVE-2025-4379","https://studiofabryka.pl/Systemy_CMS.html"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/4xxx/CVE-2025-4379.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-4379","state":"PUBLISHED","datePublished":"2025-05-23T10:00:10.396Z","dateUpdated":"2025-05-23T12:13:45.256Z","assignerShortName":"CERT-PL","assignerOrgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateReserved":"2025-05-06T10:06:58.896Z"},"containers":{"cna":{"title":"Reflected XSS in DobryCMS","descriptions":[{"lang":"en","value":"DobryCMS in versions 2.* and lower is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in szukaj parameter allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened.\n\nA hotfix for affected versions was released on 29.04.2025. It removes the vulnerability without incrementing the version."}],"affected":[{"vendor":"Studio Fabryka","product":"DobryCMS","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.*","versionType":"semver"}]}],"references":[{"url":"https://cert.pl/posts/2025/05/CVE-2025-4379","tags":["third-party-advisory"]},{"url":"https://cert.pl/en/posts/2025/05/CVE-2025-4379","tags":["third-party-advisory"]},{"url":"https://studiofabryka.pl/Systemy_CMS.html","tags":["product"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-PL","orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateUpdated":"2025-05-23T10:00:10.396Z"},"credits":[{"lang":"en","type":"finder","value":"Kamil Szczurowski"},{"lang":"en","type":"finder","value":"Robert Kruczek"}],"impacts":[{"capecId":"CAPEC-591","descriptions":[{"lang":"en","value":"CAPEC-591 Reflected XSS"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-23T12:13:34.321414Z","id":"CVE-2025-4379","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-23T12:13:45.256Z"}}]}}}