CVE-2025-66312

MediumCVSS 5.4/10Last modified Sep 26, 2026

Description

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/accounts/groups/Grupo endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[readableName] parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 1.11.0-beta.1.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Dec 1, 2025
Last modified
Sep 26, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-663137.2ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handlCVE-2025-663147.5Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACCVE-2025-663158.8There is a configuration defect vulnerability in the version server of ZTE MF258K Pro products. Due to improper directory permission settingCVE-2025-663195.5Permission control vulnerability in the resource scheduling module. Impact: Successful exploitation of this vulnerability may affect serviceCVE-2025-66327.8A maliciously crafted PSD file, when linked or imported into Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious acCVE-2025-663204.7Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect aCVE-2025-663214.7Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect aCVE-2025-663224.7Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect aCVE-2025-663235.5Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect avaiCVE-2025-663245.5Input verification vulnerability in the compression and decompression module. Impact: Successful exploitation of this vulnerability may affeCVE-2025-663255.5Permission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service CVE-2025-663264.7Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-66312: Medium severity, CVSS 5.4 | Vulnix