CVE-2025-5010 - moonlightL hexo-boot Blog Backend index.html cross site scripting

Back Back to CVE browser

MEDIUM

moonlightL hexo-boot Blog Backend index.html cross site scripting

Published May 20, 2025

4.8

MEDIUM

CVSS 4.0

EPSS 0.41%

Description

A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0. This affects an unknown part of the file /admin/home/index.html of the component Blog Backend. The manipulation of the argument Description leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products

Vendor moonlightL Product Hexo-Boot Default
n/a
- Version
  4.3.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

moonlightL

Hexo-Boot

n/a

Version	Status	Constraints
4.3.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-94

Code Injection

References (4)

https://github.com/trengh222/hexo-boot-xss1.0/blob/yhtt/README.md
exploit
https://vuldb.com/?ctiid.309663
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.309663
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.580567
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://github.com/trengh222/hexo-boot-xss1.0/blob/yhtt/README.md		exploit
https://vuldb.com/?ctiid.309663		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.309663		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.580567		third-party-advisoryThird Party AdvisoryVDB Entry