Home > Vulnerability Database > CVE-2025-54476

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2025-54476

Good to know:

Date: September 30, 2025

Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.

Severity Score

4.3

Related Resources (8)

Url: https://developer.joomla.org/security-centre/1010-20250901-core-inadequate-content-filtering-within-the-checkattribute-filter-code.html

Url: https://github.com/joomla-framework/filter/commit/852c7e101c649500d3af58ffb8baf15d7c86d825

Url: https://github.com/joomla-framework/filter/commit/188dd3fccd6fa0532d105a52736affdf6b166217

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-54476

Url: https://developer.joomla.org/security-centre/929-20240205-core-inadequate-content-filtering-within-the-filter-code.html

Url: https://github.com/joomla/joomla-cms

Url: https://github.com/joomla-framework/filter/commit/fcde280785f188e93530f7da68102f7dd8f9f723

Url: https://www.mend.io/vulnerability-database/CVE-2025-54476

Severity Score

4.3

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Top Fix

Upgrade Version

Upgrade to version https://github.com/joomla-framework/filter.git - 2.0.6

CVSS v3.1

Base Score:	4.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	HIGH
User Interaction (UI):	REQUIRED
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

Do you need more information?

Contact Us