CVE-2025-2979

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic has been found in WCMS 11. This affects an unknown part of the file /index.php?anonymous/setregister of the component Registration. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Mar 31, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-297905.4Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This CVE-2025-297917.8Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-297927.3Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.CVE-2025-297937.2Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-297948.8Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-297957.8Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate pCVE-2025-297964.7User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing CVE-2025-29803.5A vulnerability classified as problematic was found in Legrand SMS PowerView 1.x. This vulnerability affects unknown code. The manipulation CVE-2025-298007.8Improper privilege management in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.CVE-2025-298017.8Incorrect default permissions in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.CVE-2025-298027.3Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-298037.3Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to e
CVE-2025-2979: Medium severity, CVSS 5.4 | Vulnix