Cross-Site Scripting Vulnerability in Masa CMS Versions
CVE-2025-66492

8.2HIGH

Key Information:

Vendor

Masacms

Status
Masacms
Vendor
CVE Published:
12 December 2025

What is CVE-2025-66492?

Masa CMS, an open source Enterprise Content Management platform, is exposed to a vulnerability where an unsanitized ajax URL query parameter can lead to Cross-Site Scripting (XSS) attacks. This occurs due to the direct inclusion of untrusted data within the page's section, allowing attackers to execute arbitrary scripts within the user's session. Potential consequences include session hijacking, data theft, defacement, and malware distribution. To mitigate this vulnerability, it is recommended to upgrade to the fixed versions or implement Web Application Firewall (WAF) rules along with server-side sanitization methods.

Affected Version(s)

MasaCMS < 7.2.9 < 7.2.9

MasaCMS >= 7.3.1, < 7.3.14 < 7.3.1, 7.3.14

MasaCMS >= 7.4.0-alpha.1, < 7.4.8 < 7.4.0-alpha.1, 7.4.8

References

https://github.com/MasaCMS/MasaCMS/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/MasaCMS/MasaCMS/commit/376c27196b1e248...
x_refsource_MISC

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-66492 : Cross-Site Scripting Vulnerability in Masa CMS Versions