CVE-2025-51487

A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.5, allowing to execute arbitrary JavaScript by using "javascript:" payload, instead of the expected HTTPS protocol, in the CutCode Link parameter when creating/updating a new Article.

Score

CVSS 3.1 4.5 Medium

Status

Analyzed - cve@mitre.org

Published

2025-08-19

Last modified

2025-08-20

Weaknesses

CWE-79

Affected products

• Moonshine (Moonshine)

References

• https://github.com/GiacoLenzo2109/MoonShine_Software_PoCs
• https://github.com/moonshine-software/moonshine