CVE-2025-50481

Mezzanine CMS vulnerable to Cross-site Scripting

4.8 MediumPublic exploit

A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a blog post.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.69%Up 0.7 points since Jul 24, 2025

What each source reports

CVE List Score used 4.8

Record: CVE-2025-50481
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2025-22459 4.8

Record: EUVD-2025-22459
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-269j-37ww-cmh3 4.8

Mezzanine CMS vulnerable to Cross-site Scripting

Record: GHSA-269j-37ww-cmh3
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 4.8

Record: CVE-2025-50481
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 4.8

Record: CVE-2025-50481
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-269j-37ww-cmh3 4.8

Mezzanine CMS vulnerable to Cross-site Scripting

Record: GHSA-269j-37ww-cmh3
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVPYSEC-2025-137 4.8

Record: PYSEC-2025-137
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

jupo mezzanine

Affected packages

Affected packages
Package	Affected	Fixed
`mezzanine` PyPI	through 6.1.0	None known
`mezzanine` PyPI	through 6.1.0, plus listed versions 0.10.1.10.1.20.1.30.1.4 Show 45 moreShow less 0.100.10.10.10.20.10.30.10.40.10.50.10.60.110.11.10.11.100.11.20.11.30.11.40.11.50.11.60.11.70.11.80.11.90.120.12.10.12.20.12.30.12.40.12.50.20.2.10.2.20.2.30.2.40.3.00.3.10.3.20.3.30.3.40.3.50.40.5.10.5.20.5.30.5.40.60.6.10.6.20.6.30.6.4	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Mezzanine CMS 6.1.0 - Stored Cross Site Scripting (XSS)	2025-07-28
PoC in GitHub	kevinpdicks/Mezzanine-CMS-6.1.0-XSS	2025-07-05

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-50481 is a medium vulnerability (CVSS 4.8) in Jupo Mezzanine, published July 23, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 52nd percentile. No source names a fixed version.

References

This page doesn't list everything

Left out here: 89 versions. The JSON record has them.