Search
Find a vulnerability
Search criteria
2 vulnerabilities found for grapesjs_cms by aimeos
CVE-2025-66468 (GCVE-0-2025-66468)
Vulnerability from nvd – Published: 2025-12-02 18:40 – Updated: 2025-12-02 19:25
VLAI
EPSS
VEX
Title
Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors
Summary
The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/aimeos/ai-cms-grapesjs/securit… | x_refsource_CONFIRM |
| https://github.com/aimeos/ai-cms-grapesjs/commit/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| aimeos | ai-cms-grapesjs |
Affected:
>= 2021.04.1, < 2021.10.8
Affected: >= 2022.04.1, < 2022.10.9 Affected: >= 2023.04.1, < 2023.10.15 Affected: >= 2024.04.1, < 2024.10.8 Affected: >= 2025.04.1, < 2025.10.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-66468",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-02T19:25:41.414590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-02T19:25:50.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ai-cms-grapesjs",
"vendor": "aimeos",
"versions": [
{
"status": "affected",
"version": "\u003e= 2021.04.1, \u003c 2021.10.8"
},
{
"status": "affected",
"version": "\u003e= 2022.04.1, \u003c 2022.10.9"
},
{
"status": "affected",
"version": "\u003e= 2023.04.1, \u003c 2023.10.15"
},
{
"status": "affected",
"version": "\u003e= 2024.04.1, \u003c 2024.10.8"
},
{
"status": "affected",
"version": "\u003e= 2025.04.1, \u003c 2025.10.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-02T18:40:44.081Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg"
},
{
"name": "https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042"
}
],
"source": {
"advisory": "GHSA-424m-fj2q-g7vg",
"discovery": "UNKNOWN"
},
"title": "Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-66468",
"datePublished": "2025-12-02T18:40:44.081Z",
"dateReserved": "2025-12-02T15:43:16.585Z",
"dateUpdated": "2025-12-02T19:25:50.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-66468 (GCVE-0-2025-66468)
Vulnerability from cvelistv5 – Published: 2025-12-02 18:40 – Updated: 2025-12-02 19:25
VLAI
EPSS
VEX
Title
Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors
Summary
The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/aimeos/ai-cms-grapesjs/securit… | x_refsource_CONFIRM |
| https://github.com/aimeos/ai-cms-grapesjs/commit/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| aimeos | ai-cms-grapesjs |
Affected:
>= 2021.04.1, < 2021.10.8
Affected: >= 2022.04.1, < 2022.10.9 Affected: >= 2023.04.1, < 2023.10.15 Affected: >= 2024.04.1, < 2024.10.8 Affected: >= 2025.04.1, < 2025.10.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-66468",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-02T19:25:41.414590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-02T19:25:50.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ai-cms-grapesjs",
"vendor": "aimeos",
"versions": [
{
"status": "affected",
"version": "\u003e= 2021.04.1, \u003c 2021.10.8"
},
{
"status": "affected",
"version": "\u003e= 2022.04.1, \u003c 2022.10.9"
},
{
"status": "affected",
"version": "\u003e= 2023.04.1, \u003c 2023.10.15"
},
{
"status": "affected",
"version": "\u003e= 2024.04.1, \u003c 2024.10.8"
},
{
"status": "affected",
"version": "\u003e= 2025.04.1, \u003c 2025.10.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-02T18:40:44.081Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg"
},
{
"name": "https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042"
}
],
"source": {
"advisory": "GHSA-424m-fj2q-g7vg",
"discovery": "UNKNOWN"
},
"title": "Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-66468",
"datePublished": "2025-12-02T18:40:44.081Z",
"dateReserved": "2025-12-02T15:43:16.585Z",
"dateUpdated": "2025-12-02T19:25:50.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}