Vulnerability · Published May 21, 2025 · Assigned by VulDB
CVE-2025-5013HkCms Search index.html cross site scripting
Medium 4.3
In plain English
A medium-severity cross-site scripting in HkCms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.7%top 46.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index.php/search/index.html of the component Search. The manipulation of the argument keyword leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- VDB-309729 | HkCms Search index.html cross site scripting vdb-entry, technical-description
- VDB-309729 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- https://gitee.com/Hk_Cms/HkCms/issues/IBZ2G7 exploit, issue-tracking