CVE-2025-45055: Cross-site Scripting
Source CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 23% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 9 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, European organizations should implement the following specific measures: 1) Immediately restrict the ability to upload SVG files or any vector graphics as event attachments until a patch is available. 2) Enforce strict input validation and sanitization on all uploaded SVG files, ideally by disabling script execution within SVG content or converting SVGs to safer formats before rendering. 3) Enhance CSRF protections by implementing robust anti-CSRF tokens and verifying the origin of requests, especially for administrative actions. 4) Limit event attachment upload permissions to the minimum necessary user roles and monitor upload activities for suspicious behavior. 5) Educate administrators to be cautious when viewing event attachments and to report any unusual behavior. 6) Implement strong authentication and session management controls to reduce the risk of compromised user accounts. 7) Monitor logs for unusual administrative account creation or privilege changes. 8) Prepare for rapid patch deployment once an official fix is released by Silverpeas or the community. These targeted actions go beyond generic advice by focusing on the specific attack vector (SVG uploads) and the privilege escalation mechanism.
Description
Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attackers to escalate privileges by creating a new administrator account. The vulnerability arises from insufficient sanitization of SVG files and weak CSRF protections.