CVE-2025-25054

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and a user accesses a crafted page while logged in to the affected product, an arbitrary script may be executed on the web browser of the user.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Six Apart Ltd.	Movable Type (8.4.x series)	8.4.1 and earlier
Six Apart Ltd.	Movable Type (8.0.x series)	8.0.5 and earlier
Six Apart Ltd.	Movable Type Advanced (8.4.x series)	8.4.1 and earlier
Six Apart Ltd.	Movable Type Advanced (8.0.x series)	8.0.5 and earlier
Six Apart Ltd.	Movable Type Premium (2.x series)	2.06 and earlier
Six Apart Ltd.	Movable Type Premium (Advanced Edition) (2.x series)	2.06 and earlier
Six Apart Ltd.	Movable Type Cloud Edition (8.x series)	8.4.1 and earlier
Six Apart Ltd.	Movable Type Premium Cloud Edition (2.x series)	2.06 and earlier

References

Timeline

Published: Feb 19, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-250555.3Authentication bypass by spoofing issue exists in FileMegane versions above 1.0.0.0 prior to 3.4.0.0, which may lead to user impersonation. CVE-2025-250564.3Cross-site request forgery vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views a malicious page while logged in, uni CVE-2025-250575.5in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory.CVE-2025-250583.3Improper initialization for some ESXi kernel mode driver for the Intel(R) Ethernet 800-Series before version 2.2.2.0 (esxi 8.0) & 2.2.3.CVE-2025-250596.7Uncontrolled search path for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User Applicat CVE-2025-25065.3When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access t CVE-2025-250608.2Missing authentication for critical function vulnerability exists in AssetView and AssetView CLOUD. If exploited, the files on the server wh CVE-2025-250615.8Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remot CVE-2025-250624.4An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content CVE-2025-250634.4An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG im CVE-2025-250648.8SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 d CVE-2025-250655.3SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 all