VULNERABILITY INTELLIGENCE

CVE-2025-69437

CVSS score8.7 HIGH

EPSS probability0.16%

CISA KEVNot currently listed

Published2026-02-27

Last modified2026-06-17

Description

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system and views it, the embedded JavaScript payload can be…