VULNERABILITY INTELLIGENCE

CVE-2025-64112

CVSS score8 HIGH
EPSS probability0.30%
CISA KEVNot currently listed
Published2025-10-30
Last modified2026-10-07
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Description

Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fixed in 5.22.1.

Weakness classification

  • security-advisories@github.com: CWE-79

Primary references