CVE-2025-48954

Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled...

CVE-2025-48954

creationtimestamp| type| source ---|---|--- 2025-06-25 14:51:34+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19462 2025-08-05 19:56:00+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-48954.yaml 2025-08-06...

CVE-2025-48954 Discourse vulnerable to XSS via user-provided query parameter in oauth failure flow

Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled...

CVE-2025-48954

Discourse CVE-2025-48954 affects versions prior to 3.5.0.beta6, where a Cross-site Scripting (XSS) vulnerability exists in the OAuth/social login flow due to insufficient Content Security Policy enforcement during login failures. The stored XSS can allow injection and execution of scripts in vict...