CVE-2025-51488

MEDIUM EPSS 40.3%

Published Aug 19, 202510mo ago · Modified Jun 17, 20261w ago

4.9 CVSS 3.1

Medium

Published Aug 19, 2025 10mo ago

Last Modified Jun 17, 2026 1w ago

Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.4, allowing remote attackers to store and execute arbitrary JavaScript by including a malicious HTML payload in the Name parameter when creating a new Admin.

CVSS Details

Base Score

4.9

Exploitability

1.2

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required High

User Interaction None

Scope Unchanged

Confidentiality High

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

40.3% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
moonshine	moonshine	*	<3.12.5

References 2

github.com https://github.com/GiacoLenzo2109/MoonShine_Software_PoCs

ExploitThird Party Advisory
github.com https://github.com/moonshine-software/moonshine

Product

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.