CVE-2025-50754

9.6 criticalEPSS 0.6%

Critical (9.6). EPSS 0.6% chance of exploitation in the next 30 days.

Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality. A malicious script submitted by an attacker is rendered in the admin panel when viewed by an administrator. This allows attackers to hijack the admin session and, by leveraging the template editor, upload and execute a PHP web shell on the server, leading to full remote code execution.

Severity

CVSS 3.1

9.6 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-08-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/furk4nyildiz/CVE-2025-50754-PoC
https://github.com/furk4nyildiz/CVE-2025-50754-PoC

Check your stack JSON