CVE-2025-56236: n/a
Source CVE Database V5
Not known to be exploited · CVSS 6.1 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 28 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
AI-suggested
To mitigate CVE-2025-56236 effectively, European organizations should implement the following specific measures: 1) Immediately restrict or disable the avatar upload feature until a patch or update is available. 2) Enforce strict file type validation on the server side to block uploading of .html or any executable/script files; only allow safe image formats such as .jpg, .png, or .gif. 3) Implement robust input sanitization and output encoding to neutralize any embedded scripts in uploaded content. 4) Apply Content Security Policy (CSP) headers to limit the execution of inline scripts and restrict resource loading to trusted domains. 5) Monitor and audit user uploads and access logs to detect suspicious activity or attempts to upload malicious files. 6) Educate privileged users about the risk of clicking on untrusted links or viewing unverified content within the CMS. 7) Segregate user roles and enforce the principle of least privilege to minimize the number of users who can upload content and access sensitive areas. 8) Prepare incident response plans to quickly address any exploitation attempts. 9) Stay updated with vendor advisories and apply patches promptly once released. These measures go beyond generic advice by focusing on both prevention of malicious uploads and minimizing the impact if exploitation occurs.
Description
FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.