CVE-2025-5011

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0. This vulnerability affects unknown code of the file /admin/home/index.html of the component Dynamic List Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
moonlightL	hexo-boot	4.3.0

References

https://github.com/trengh222/hexo-boot-xss2.0Exploit
https://vuldb.com/?ctiid.309664Permissions Required, VDB Entry
https://vuldb.com/?id.309664Third Party Advisory, VDB Entry
https://vuldb.com/?submit.580588Third Party Advisory, VDB Entry
https://github.com/trengh222/hexo-boot-xss2.0Exploit

Timeline

Published: May 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-501108.8An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, the GetHttpsResponse m CVE-2025-50128.8The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due CVE-2025-501219.5A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause u CVE-2025-501228.9A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reve CVE-2025-501237.2A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote command execution by a pri CVE-2025-501247.2A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a pr CVE-2025-501256.3A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execution when the server CVE-2025-501265.3A stored XSS vulnerability in the RSBlog! component 1.11.6-1.14.5 Joomla was discovered. The issue allows remote authenticated users to inje CVE-2025-501278.5A SQLi vulnerability in DJ-Flyer component 1.0-3.2 for Joomla was discovered. The issue allows privileged users to execute arbitrary SQL com CVE-2025-501286.1A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev maste CVE-2025-501298.8A memory corruption vulnerability exists in the PCX Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. When decoding th CVE-2025-50134.7A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index