moonshine Stored Cross-Site Scripting Vulnerability in Create Article

A stored cross-site scripting XSS vulnerability in the Create Article function of MoonShine v3.12.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Link parameter...

GHSA-8XFQ-7F6M-MPMF MoonShine Arbitrary File Upload Vulnerability

An arbitrary file upload vulnerability in MoonShine v3.12.4 allows attackers to execute arbitrary code via uploading a crafted SVG file...

GHSA-9G9J-3W64-3CJH MoonShine SQL Injection Vulnerability

MoonShine v3.12.5 was discovered to contain a SQL injection vulnerability via the Data parameter under the Blog module...

CVE-2025-51488

A Stored Cross-Site Scripting XSS vulnerability exists in MoonShine version 3.12.4, allowing remote attackers to store and execute arbitrary JavaScript by including a malicious HTML payload in the Name parameter when creating a new Admin...

CVE-2025-51510

MoonShine was discovered to contain a SQL injection vulnerability under the Blog - Categories page when using the moonshine-tree-resource version 2.0.2 component...

CVE-2025-51487

A Stored Cross-Site Scripting XSS vulnerability exists in MoonShine version 3.12.5, allowing to execute arbitrary JavaScript by using "javascript:" payload, instead of the expected HTTPS protocol, in the CutCode Link parameter when creating/updating a new Article...

CVE-2025-51489

A Stored Cross-Site Scripting XSS vulnerability exists in MoonShine version 3.12.5, allowing remote attackers to upload a malicious SVG file when creating/updating an Article and correctly execute arbitrary JavaScript when the file link is opened...

CVE-2025-51488

MoonShine, a Laravel-based admin panel, is affected by CVE-2025-51488 due to a Stored XSS in the Create Admin flow. The vulnerability arises from improper sanitization of the Name parameter when creating a new Admin, allowing an attacker to store and execute arbitrary JavaScript in victims’ brows...

PT-2025-33740 · Moonshine · Moonshine

Name of the Vulnerable Software and Affected Versions: MoonShine version 3.12.4 Description: An arbitrary file upload vulnerability exists in MoonShine version 3.12.4. Attackers can execute arbitrary code by uploading a crafted SVG file. Recommendations: At the moment, there is no information abo...

CVE-2025-51488

A Stored Cross-Site Scripting XSS vulnerability exists in MoonShine version 3.12.4, allowing remote attackers to store and execute arbitrary JavaScript by including a malicious HTML payload in the Name parameter when creating a new Admin...

CVE-2025-51487

A Stored Cross-Site Scripting XSS vulnerability exists in MoonShine version 3.12.5, allowing to execute arbitrary JavaScript by using "javascript:" payload, instead of the expected HTTPS protocol, in the CutCode Link parameter when creating/updating a new Article...

CVE-2025-51489

A Stored Cross-Site Scripting XSS vulnerability exists in MoonShine version 3.12.5, allowing remote attackers to upload a malicious SVG file when creating/updating an Article and correctly execute arbitrary JavaScript when the file link is opened...

Moonshine 安全漏洞

Moonshine is a MoonShine open source admin panel software. A security vulnerability exists in Moonshine version v3.12.3, which stems from a parameter injection that could lead to a stored cross-site scripting attack...

CVE-2025-51487

A Stored Cross-Site Scripting XSS vulnerability exists in MoonShine version 3.12.5, allowing to execute arbitrary JavaScript by using "javascript:" payload, instead of the expected HTTPS protocol, in the CutCode Link parameter when creating/updating a new Article...

CVE-2025-51487

CVE-2025-51487 describes a Stored XSS in MoonShine that affects versions older than 3.12.5. An attacker can inject a javascript: payload via the CutCode Link parameter when creating/updating an Article, leading to arbitrary JavaScript execution in the victim’s browser. Affected software: MoonShin...

CVE-2025-51510

MoonShine contains a SQL injection in the Blog module via the data parameter of the moonshine-tree-resource component (versions Categories page. Root cause: unsafely embedded data parameter allows injection; PoCs and public reports describe extracting data from moonshine_users and demonstrating ...

CVE-2025-51510

MoonShine was discovered to contain a SQL injection vulnerability under the Blog - Categories page when using the moonshine-tree-resource version 2.0.2 component...

CVE-2025-51487

A Stored Cross-Site Scripting XSS vulnerability exists in MoonShine version 3.12.5, allowing to execute arbitrary JavaScript by using "javascript:" payload, instead of the expected HTTPS protocol, in the CutCode Link parameter when creating/updating a new Article...

CVE-2025-51488

A Stored Cross-Site Scripting XSS vulnerability exists in MoonShine version 3.12.4, allowing remote attackers to store and execute arbitrary JavaScript by including a malicious HTML payload in the Name parameter when creating a new Admin...

Moonshine 跨站脚本漏洞

Moonshine is a MoonShine open source admin panel software. A security vulnerability exists in Moonshine version v3.12.4, which stems from improper file upload control and could lead to arbitrary code execution...