CVE-2025-5407 chaitak-gorai Blogbook register_script.php cross site scripting
Remote attackers can inject malicious scripts via the fullname parameter in the registration script of the Blogbook web application.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-5407?
CVE-2025-5407 is a medium-severity cross-site scripting vulnerability in chaitak-gorai Blogbook, published on 1 Jun 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A vulnerability has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /register_script.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2025-5407?
It affects 1 product.
Products include Chaitak-Gorai Blogbook.
How do I fix CVE-2025-5407?
No fix has been published for CVE-2025-5407 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-5407 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-5407 exists.
Other vulnerabilities in chaitak-gorai Blogbook
- CVE-2025-5400 chaitak-gorai Blogbook GET Parameter user.php sql injection
- CVE-2025-5401 chaitak-gorai Blogbook GET Parameter post.php sql injection
- CVE-2025-5402 chaitak-gorai Blogbook GET Parameter edit_post.php sql injection
- CVE-2025-5403 chaitak-gorai Blogbook GET Parameter view_all_posts.php sql injection
- CVE-2025-5404 chaitak-gorai Blogbook GET Parameter search.php denial of service
Sources
Also known as GHSA-p9pm-v555-5528.