CVE-2025-66468

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-66468", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-02T15:43:16.585Z", "datePublished": "2025-12-02T18:40:44.081Z", "dateUpdated": "2025-12-02T19:25:50.350Z"}, "containers": {"cna": {"title": "Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg"}, {"name": "https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042", "tags": ["x_refsource_MISC"], "url": "https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042"}], "affected": [{"vendor": "aimeos", "product": "ai-cms-grapesjs", "versions": [{"version": ">= 2021.04.1, < 2021.10.8", "status": "affected"}, {"version": ">= 2022.04.1, < 2022.10.9", "status": "affected"}, {"version": ">= 2023.04.1, < 2023.10.15", "status": "affected"}, {"version": ">= 2024.04.1, < 2024.10.8", "status": "affected"}, {"version": ">= 2025.04.1, < 2025.10.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-02T18:40:44.081Z"}, "descriptions": [{"lang": "en", "value": "The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8."}], "source": {"advisory": "GHSA-424m-fj2q-g7vg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-02T19:25:41.414590Z", "id": "CVE-2025-66468", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-02T19:25:50.350Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-66468", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-02T19:25:41.414590Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-02T19:25:46.371Z"}}], "cna": {"title": "Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors", "source": {"advisory": "GHSA-424m-fj2q-g7vg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "aimeos", "product": "ai-cms-grapesjs", "versions": [{"status": "affected", "version": ">= 2021.04.1, < 2021.10.8"}, {"status": "affected", "version": ">= 2022.04.1, < 2022.10.9"}, {"status": "affected", "version": ">= 2023.04.1, < 2023.10.15"}, {"status": "affected", "version": ">= 2024.04.1, < 2024.10.8"}, {"status": "affected", "version": ">= 2025.04.1, < 2025.10.2"}]}], "references": [{"url": "https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg", "name": "https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042", "name": "https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-02T18:40:44.081Z"}}}, "cveMetadata": {"cveId": "CVE-2025-66468", "state": "PUBLISHED", "dateUpdated": "2025-12-02T19:25:50.350Z", "dateReserved": "2025-12-02T15:43:16.585Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-12-02T18:40:44.081Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ai-cms-grapesjs", "vendor": "aimeos", "versions": [{"status": "affected", "version": ">= 2021.04.1, < 2021.10.8"}, {"status": "affected", "version": ">= 2022.04.1, < 2022.10.9"}, {"status": "affected", "version": ">= 2023.04.1, < 2023.10.15"}, {"status": "affected", "version": ">= 2024.04.1, < 2024.10.8"}, {"status": "affected", "version": ">= 2025.04.1, < 2025.10.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:aimeos:grapesjs_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "C0FCB6FE-18A7-45B2-B339-0BD693C023EC", "versionEndExcluding": "2021.10.8", "versionStartIncluding": "2021.04.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:aimeos:grapesjs_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F2DCAA9-41AC-4650-940C-8053478BA456", "versionEndExcluding": "2022.10.9", "versionStartIncluding": "2022.04.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:aimeos:grapesjs_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FF92937-D16D-475A-AD25-CB1BABC551A5", "versionEndExcluding": "2023.10.15", "versionStartIncluding": "2023.04.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:aimeos:grapesjs_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "08BF8C10-4F1F-4734-BD4C-40DE39959FB0", "versionEndExcluding": "2024.10.8", "versionStartIncluding": "2024.04.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:aimeos:grapesjs_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B5E16CE-DC04-4A08-A975-922B6ECE1F00", "versionEndExcluding": "2025.10.2", "versionStartIncluding": "2025.04.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. This vulnerability is fixed in 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8."}, {"lang": "es", "value": "La extensi\u00f3n Aimeos GrapesJS CMS proporciona un editor de p\u00e1ginas para crear p\u00e1ginas de contenido basado en componentes extensibles. Versiones anteriores a 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8 y 2025.10.8, se puede inyectar c\u00f3digo Javascript por editores maliciosos para un ataque de XSS almacenado si la Pol\u00edtica de Seguridad de Contenido est\u00e1ndar est\u00e1 deshabilitada. Esta vulnerabilidad est\u00e1 corregida en 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8 y 2025.10.8."}], "id": "CVE-2025-66468", "lastModified": "2026-10-18T18:10:00.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66468", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-02T19:25:41.414590Z", "version": "2.0.3"}}]}, "published": "2025-12-02T19:15:53.310", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/aimeos/ai-cms-grapesjs/commit/2214f71ac27cdea25f11c8adf6bb5816db47a042"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/aimeos/ai-cms-grapesjs/security/advisories/GHSA-424m-fj2q-g7vg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-12-04T16:44:42.997041+00:00", "updated": "2025-12-04T16:44:42.997069+00:00", "vendors": ["aimeos", "aimeos$PRODUCT$ai-cms-grapesjs"]}