CVE-2025-2123

GeSHi CSS cssgen.php get_var cross site scripting

CVSS 5.1 MEDIUMEPSS 0.4%CWE-79 CWE-94

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 5.1EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

09 mar 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

A vulnerability, which was classified as problematic, has been found in GeSHi up to 1.0.9.1. Affected by this issue is the function get_var of the file /contrib/cssgen.php of the component CSS Handler. The manipulation of the argument default-styles/keywords-1/keywords-2/keywords-3/keywords-4/comments leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Productos afectados

n/a · GeSHi

Referencias

https://github.com/GeSHi/geshi-1.0/issues/159 https://github.com/GeSHi/geshi-1.0/issues/159#issue-2880408694 https://vuldb.com/?ctiid.299036 https://vuldb.com/?id.299036 https://vuldb.com/?submit.507418