CVE-2025-56236: 
C# vulnerability analysis and mitigation

FormCms version 0.5.5 contains a stored cross-site scripting (XSS) vulnerability that was discovered and reported on July 8, 2025. The vulnerability affects the avatar upload feature of the application and has been assigned identifier CVE-2025-56236. The issue has received a CVSS v3.1 base score of 6.1 (Medium) from CISA-ADP (NVD).

The vulnerability exists in the avatar upload feature where authenticated users can upload .html files containing malicious JavaScript code through the /api/profile/avatar endpoint. These uploaded files are stored at publicly accessible locations under /files/avatar/[random-id].html. The files remain accessible without any authentication or access control measures in place (GitHub Issue).

When a privileged user, such as a Super Admin, accesses the malicious file either directly or through social engineering, the embedded JavaScript executes in their browser context. This allows attackers to perform unauthorized API operations with the victim's elevated privileges, including full CRUD (Create, Read, Update, Delete) operations on users, roles, and other sensitive application data (GitHub Issue).