medium6.1
CVE-2025-61183
VaahCMS is vulnerable to XSS through its Avatar Upload endpoint
Impact
Cross-Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | webreinvent/vaahcms | <= 2.3.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Webreinvent | Vaahcms | Version 2.3.1 |