CVE-2025-2979 - WCMS Registration setregister cross site scripting

Back Back to CVE browser

MEDIUM

WCMS Registration setregister cross site scripting

Published Mar 31, 2025

4.8

MEDIUM

CVSS 4.0

EPSS 0.38%

Description

A vulnerability classified as problematic has been found in WCMS 11. This affects an unknown part of the file /index.php?anonymous/setregister of the component Registration. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor n/a Product WCMS Default
n/a
- Version
  11
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

WCMS

n/a

Version	Status	Constraints
11	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-94

Code Injection

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-8714
Advisory
https://github.com/caigo8/CVE-md/blob/main/wcms11/%E5%AD%98%E5%82%A8%E5%9E%8BXSS.md
exploitThird Party Advisory
https://vuldb.com/?ctiid.302031
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.302031
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.523896
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-8714		Advisory
https://github.com/caigo8/CVE-md/blob/main/wcms11/%E5%AD%98%E5%82%A8%E5%9E%8BXSS.md		exploitThird Party Advisory
https://vuldb.com/?ctiid.302031		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.302031		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.523896		third-party-advisoryThird Party AdvisoryVDB Entry