CVE-2025-48447

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site Scripting (XSS).This issue affects Lightgallery: from 0.0.0 before 1.6.0.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
DrupalLightgallery>= 0.0.0, < 1.6.0

References

Timeline

Published
Jun 11, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-484486.5Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affectCVE-2025-48459.8A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0. Affected by this issue is some unknown functiCVE-2025-484595.3Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recomCVE-2025-48469.8A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component MPUTCVE-2025-484615.0Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover asCVE-2025-484624.2Successful exploitation of the vulnerability could allow an attacker to consume all available session slots and block other users from loggiCVE-2025-484633.1Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as CVE-2025-484644.7Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as CVE-2025-484668.1Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate DigitaCVE-2025-484676.5Successful exploitation of the vulnerability could allow an attacker to cause repeated reboots, potentially leading to remote denial-of-servCVE-2025-484686.4Successful exploitation of the vulnerability could allow an attacker that has physical access to interface with JTAG to inject or modify firCVE-2025-484699.6Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public update page, potent
CVE-2025-48447: High severity, CVSS 7.1 | Vulnix