PT-2025-7527

CVE-2025-1548

Published

2025-02-21

Updated

2025-02-21

Description by

CVSS 3.1

4.6

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions iteachyou Dreamer CMS version 4.1.3

Description A vulnerability was found in iteachyou Dreamer CMS, affecting unknown code of the file /admin/archives/edit. The manipulation of the editorValue/answer/content argument leads to cross-site scripting. The attack can be initiated remotely.

Recommendations For iteachyou Dreamer CMS version 4.1.3, consider disabling access to the /admin/archives/edit file until a patch is available. Restrict the use of the editorValue/answer/content argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Vastzero

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-918: Server-Side Request Forgery (SSRF)

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers