CVE-2025-5013

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index.php/search/index.html of the component Search. The manipulation of the argument keyword leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: May 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-501307.8A heap-based buffer overflow vulnerability exists in VS6Sim.exe contained in V-SFT and TELLUS provided by FUJI ELECTRIC CO., LTD. Opening V CVE-2025-50148.8The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path val CVE-2025-50158.8A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS CVE-2025-501518.8File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena vers CVE-2025-501527.8Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2025-501537.8Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally.CVE-2025-501546.5Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over CVE-2025-501557.8Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privile CVE-2025-501565.7Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over CVE-2025-501575.7Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over CVE-2025-501587.0Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an unauthorized attacker to disclose information locally.CVE-2025-501597.3Use after free in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an authorized attacker to elevate privileges locally.