CVE-2025-54411

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcome_banner.header.logged_in_members site text to remove the preferred_display_name placeholder, or not impersonate any users for the time being. This vulnerability is fixed in 3.5.0.beta8.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-544128.7skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain a inconsistenc CVE-2025-544138.7skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain an inconsisten CVE-2025-544145.1Anubis is a Web AI Firewall Utility that weighs the soul of users' connections using one or more challenges in order to protect upstream res CVE-2025-544159.1dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0a8 and below, a high CVE-2025-544169.1tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. CVE-2025-544178.8Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerability that ca CVE-2025-544189.8CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications tha CVE-2025-5441910.0A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) origin CVE-2025-54429.8A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1 CVE-2025-544215.4NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC CVE-2025-544225.5Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a cr CVE-2025-544236.1copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitra