Wagtail-CMS-XSS

Wagtail-6.4.1-CMS-XSS CVE-2025-45388 Wagtail CMS 6.4.1 存储型 XSS CMS 存储型 XSS 漏洞 PoC 概述 本仓库演示了在 Wagtail 6.4.1 CMS 平台中发现的一个存储型 XSS 漏洞。一段恶意 JavaScript 被嵌入到 PDF 文件中，每当用户点击该 PDF 时，都会弹出一个 XSS 弹窗。 复现步骤 1. 上传一个包含恶意脚本的 PDF 文档，例如本仓库中提供的那个。 2. 访问 CMS 并找到恶意 PDF。 3. 点击 PDF 链接。 4. 恶意 JavaScript 将被触发，并在每次打开 PDF 时...

CVE-2025-45388

creationtimestamp| type| source ---|---|--- 2025-05-07 19:22:18+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15384 2025-05-07 22:27:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lomgxujgzs2p 2025-05-07 23:12:15+00:00| seen|...

CVE-2025-45388

Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting XSS in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface, the payload executes. NOTE: this is disputed by the Supplier because "It has been...

CVE-2025-45388

Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting XSS in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface, the payload executes. NOTE: this is disputed by the Supplier because "It has been...