First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-63082

MediumCVSS 6.1/10Last modified Oct 7, 2026

Description

Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Joomla! Project	Joomla! CMS	4.0.0-5.4.1; 6.0.0-6.0.1

References

https://developer.joomla.org/security-centre/1016-20260101-core-inadequate-content-filtering-for-data-urls.htmlVendor Advisory

Timeline

Published: Jan 6, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-630836.1Lack of output escaping leads to a XSS vector in the pagebreak plugin.CVE-2025-63098.8A vulnerability classified as critical was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this vulnerability is an u CVE-2025-630947.5XiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and indirect branch prediction, allowing attackers CVE-2025-630956.5Improper input validation in the BitstreamWriter::write_bits() function of Tempus Ex hello-video-codec v0.1.0 allows attackers to cause a De CVE-2025-63109.8A vulnerability, which was classified as critical, has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this issu CVE-2025-63119.8A vulnerability, which was classified as critical, was found in Campcodes Sales and Inventory System 1.0. This affects an unknown part of th CVE-2025-63129.8A vulnerability has been found in Campcodes Sales and Inventory System 1.0 and classified as critical. This vulnerability affects unknown co CVE-2025-63139.8A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. This issue affects some unknown processing CVE-2025-63149.8A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as critical. Affected is an unknown function o CVE-2025-631477.5Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function. This v CVE-2025-631497.5Tenda AX3 V16.03.12.10_CN was discovered to contain a stack overflow in the urls parameter of the get_parentControl_list_Info function. This CVE-2025-63159.8A vulnerability was found in code-projects Online Shoe Store 1.0. It has been declared as critical. Affected by this vulnerability is an unk

CVE-2025-63082: Medium severity, CVSS 6.1 | Vulnix