Vulnerability DatabaseCVE-2025-51487

CVE-2025-51487:
PHP vulnerability analysis and mitigation

Overview

A Stored Cross-Site Scripting (XSS) vulnerability (CVE-2025-51487) was discovered in MoonShine versions prior to 3.12.5. The vulnerability was disclosed on August 19, 2025, and allows attackers to execute arbitrary JavaScript by using 'javascript:' payload in the CutCode Link parameter when creating or updating a new Article (NVD, MoonShine PoCs).

Technical details

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS v3.1 Base Score of 4.5 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N. The vulnerability is tracked as CWE-79 (Improper Neutralization of Input During Web Page Generation). The issue specifically occurs in the Article creation/update functionality where the CutCode Link parameter fails to properly validate and sanitize input, allowing the injection of JavaScript protocol handlers instead of the expected HTTPS protocol (NVD).

Impact

When successfully exploited, this vulnerability allows attackers to store and execute arbitrary JavaScript in the browser of users who view the affected article. This can lead to potential theft of sensitive information, session hijacking, or other client-side attacks (MoonShine PoCs).

Mitigation and workarounds

Users are advised to upgrade to MoonShine version 3.12.5 or later which contains fixes for this vulnerability. The update addresses the input validation issues in the CutCode Link parameter (MoonShine).