CVE-2025-50754

Status: DeferredCritical (9.6)—

Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality. A malicious script submitted by an attacker is rendered in the admin panel when viewed by an administrator. This allows attackers to hijack the admin session and, by leveraging the template editor, upload and execute a PHP web shell on the server, leading to full remote code execution.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Base score: 9.6

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.56%
Percentile among all scored CVEs: 45
Score date: 10/5/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1189 Drive-by Compromiseinitial access95 %
Primary impactT1059 Command and Scripting Interpreterexecution90 %
Secondary impactT1098 Account Manipulationpersistence · privilege escalation85 %
Secondary impactT1505.003 Web Shellpersistence80 %

XSS almacenado en panel admin (CWE-79, UI:R) permite inyectar scripts que secuestran sesión admin y ejecutan PHP (web shell), logrando RCE completo.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Disable or Remove Feature or Program User Account Management Restrict Web-Based Content Privileged Account Management User Training Restrict File and Directory Permissions

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Unisite — Unisite CMS^AI

CWEs

CWE-79

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2025-50754",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-50754",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-05T14:20:36.430201Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.6,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-08-04T21:15:30.400",
  "references": [
    {
      "url": "https://github.com/furk4nyildiz/CVE-2025-50754-PoC",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/furk4nyildiz/CVE-2025-50754-PoC",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the \"Report\" functionality. A malicious script submitted by an attacker is rendered in the admin panel when viewed by an administrator. This allows attackers to hijack the admin session and, by leveraging the template editor, upload and execute a PHP web shell on the server, leading to full remote code execution."
    },
    {
      "lang": "es",
      "value": "Unisite CMS versión 5.0 contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en la función \"Report\". Un script malicioso enviado por un atacante se muestra en el panel de administración cuando lo visualiza un administrador. Esto permite a los atacantes secuestrar la sesión de administrador y, mediante el editor de plantillas, cargar y ejecutar un shell web PHP en el servidor, lo que provoca la ejecución remota completa de código."
    }
  ],
  "lastModified": "2026-06-17T09:35:21.517",
  "sourceIdentifier": "cve@mitre.org"
}