CVE-2025-2583

MEDIUM EPSS 28.1%

Published Mar 21, 20251y ago · Modified Jun 17, 20261w ago

5.1 CVSS 4.0

Medium

Published Mar 21, 2025 1y ago

Last Modified Jun 17, 2026 1w ago

Description

A vulnerability was found in SimpleMachines SMF 2.1.4. It has been classified as problematic. This affects an unknown part of the file ManageNews.php. The manipulation of the argument subject/message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor does not declare this issue a security vulnerability due to authentication requirements before being able to access any feature in the software that allows file modification.

CVSS Details

Base Score

5.1

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction P

Scope X

Threat Intelligence

EPSS Exploit Probability

28.1% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 2

CWE-79 Cross-site Scripting Injection

CWE-94 Improper Control of Generation of Code (Code Injection) Injection

Affected Products 1

Vendor	Product	Version	Range
simplemachines	simple_machines_forum	2.1.4	any

References 5

github.com https://github.com/Fewword/Poc/blob/main/smf/smf-poc5.md

ExploitThird Party Advisory
github.com https://github.com/Fewword/Poc/blob/main/smf/smf-poc6.md

ExploitThird Party Advisory
vuldb.com https://vuldb.com/?ctiid.300543

Permissions RequiredVDB Entry
vuldb.com https://vuldb.com/?id.300543

Third Party AdvisoryVDB Entry
vuldb.com https://vuldb.com/?submit.512001

Third Party AdvisoryVDB Entry

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.