Cross Site Scripting Vulnerability in Ultimate PHP Board by PHP-Outburst
CVE-2025-61539

6.1MEDIUM

Key Information:

Vendor

PHP-Outburst

Status
Ultimate PHP Board
Vendor
CVE Published:
16 October 2025

What is CVE-2025-61539?

A Cross Site Scripting (XSS) vulnerability has been identified in Ultimate PHP Board version 2.2.7 through the 'u_name' parameter in the 'lostpassword.php' script. This flaw allows an attacker to inject malicious scripts, which can be executed in the context of a victim's browser session. Exploitation of this vulnerability may lead to data theft and unauthorized actions carried out on behalf of an unsuspecting user. It is crucial for users to apply updates or patches provided by PHP-Outburst to mitigate the risk associated with this exposure.

References

https://github.com/PHP-Outburst/myUPB?tab=readme-ov-file
https://github.com/bugdotexe/Vulnerability-Research/tree/...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.