{"id":"CVE-2025-56236","aliases":["EUVD-2025-26075","GHSA-4fxf-xgrm-8fcj"],"status":"published","title":"FormCms avatar upload feature has a stored cross-site scripting (XSS) vulnerability","description":"FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00203,"percentile":0.10395,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-434","CWE-79"],"published":"2025-08-28T00:00:00Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"NuGet","package":"FormCMS","fixed_in":["0.5.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"FormCMS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7"}]}]},{"source":"osv","ecosystem":"NuGet","package":"FormCMS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7"}]}],"versions":["0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.4.9","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6"]}],"products":[{"vendor":"formcms","product":"formcms"}],"references":[{"url":"https://github.com/FormCms/FormCms/issues/27","tags":["Exploit","Issue Tracking","report","web"]},{"url":"https://github.com/KKC73/me/blob/main/CVE-2025-56236/README.md","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-56236","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4fxf-xgrm-8fcj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/56xxx/CVE-2025-56236.json","tags":["advisory"]},{"url":"https://github.com/formcms/formcms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-56236","description":"FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.","status":"published","published":"2025-08-28T00:00:00Z","modified":"2025-08-28T20:03:21.922Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:26.320248Z"}],"euvd":[{"id":"EUVD-2025-26075","description":"FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.","status":"published","published":"2025-08-28T00:00:00Z","modified":"2025-08-28T20:03:21Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:50.093994Z"}],"ghsa":[{"id":"GHSA-4fxf-xgrm-8fcj","title":"FormCms avatar upload feature has a stored cross-site scripting (XSS) vulnerability","description":"FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.","status":"published","published":"2025-08-28T15:30:42Z","modified":"2025-08-28T16:47:06Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79","CWE-434"],"updated_at":"2026-11-02T14:38:55.953734Z"}],"nvd":[{"id":"CVE-2025-56236","description":"FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.","status":"published","published":"2025-08-28T15:16:02.953Z","modified":"2026-09-26T00:10:00.127Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:25.826804Z"}],"osv":[{"id":"CVE-2025-56236","description":"FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.","status":"published","published":"2025-08-28T00:00:00Z","modified":"2026-10-28T02:30:59.545539865Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:51.190588Z"},{"id":"GHSA-4fxf-xgrm-8fcj","title":"FormCms avatar upload feature has a stored cross-site scripting (XSS) vulnerability","description":"FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.","status":"published","published":"2025-08-28T15:30:42Z","modified":"2025-08-28T17:27:25.201966Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-434","CWE-79"],"updated_at":"2026-11-02T15:46:36.782754Z"}]}}