CVE detail
CVE-2025-30148
Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitized on the client-side, but server-side sanitization doesn't catch it. The server-side sanitization logic has been updated to sanitize against this attack. This vulnerability is fixed in 5.3.23.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 13.9 · diversity 10.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
3 source links · newest first
- https://www.silverstripe.org/download/security-releases/cve-2025-30148www.silverstripe.org
No excerpt available.
Vendor Advisorywww.silverstripe.orgApr 10, 2025, 1:15 PM - https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-rhx4-hvx9-j387github.com
No excerpt available.
Exploitgithub.comApr 10, 2025, 1:15 PM No excerpt available.
Exploitgithub.comApr 10, 2025, 1:15 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2024-53277CVSS 5.4 · Medium
Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In some cases, form messages can contain HTML markup. This is an intentional feature, allowing links a…
- CVE-2024-32981CVSS 5.4 · Medium
Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit content in the CMS could add send a spe…
- CVE-2022-38147CVSS 5.4 · Medium
Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3).
- CVE-2022-38145CVSS 5.4 · Medium
Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the…
- CVE-2022-37430CVSS 5.4 · Medium
Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).
- CVE-2022-37429CVSS 5.4 · Medium
Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space ch…