CVE Feed

    Dashboard / CVE / CVE-2025-45055

    CVE-2025-45055

    Silverpeas 6.4.2 contains a stored cross-site scripting (XSS) vulnerability in the event management module. An authenticated user can upload a malicious SVG file as an event attachment, which, when viewed by an administrator, executes embedded JavaScript in the admin's session. This allows attackers to escalate privileges by creating a new administrator account. The vulnerability arises from insufficient sanitization of SVG files and weak CSRF protections.

    Published:Jun 9, 2025
    Last Modified:Jun 25, 2025
    EPS:Jun 9, 2025
    EPSS Score:0.00039
    CVSS Score:5.4

    Affected Products

    Vendor
    Silverpeas
    Product
    Silverpeas

    Exploits

    https://medium.com/@mingihongkim/privilege-escalation-via-svg-injection-in-silverpeas-6-4-2-b5ab1d5b6955https://medium.com/@mingihongkim/privilege-escalation-via-svg-injection-in-silverpeas-6-4-2-b5ab1d5b6955

    Related CVEs

    CVE-2026-53698 (CVSS 6.5) — Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set.…
    CVE-2026-30139 (CVSS 6.1) — A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core be…
    CVE-2025-46047 (CVSS 6.5) — A User enumeration vulnerability in the /CredentialsServlet/ForgotPassword endpoint in Silverpeas 6.4.1 and 6.…
    CVE-2024-56923 (CVSS 5.4) — Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality…
    CVE-2024-48814 (CVSS 7.5) — SQL Injection vulnerability in Silverpeas 6.4.1 allows a remote attacker to obtain sensitive information via t…
    CVE-2024-42850 (CVSS 9.8) — An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password c…
    CVE-2024-42849 (CVSS 6.5) — An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the passwor…
    CVE-2024-39031 (CVSS 5.4) — In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Addi…
    CVE-2024-36042 (CVSS 9.8) — Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, …
    CVE-2024-29392 (CVSS 5.4) — Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High