CVE-2025-2699

Summary

A vulnerability was found in GetmeUK ContentTools up to 1.6.16. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Image Handler. The manipulation of the argument onload leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

VendorProductVersion RangeStatus
GetmeUKContentTools1.6.0affected
GetmeUKContentTools1.6.1affected
GetmeUKContentTools1.6.2affected
GetmeUKContentTools1.6.3affected
GetmeUKContentTools1.6.4affected
GetmeUKContentTools1.6.5affected
GetmeUKContentTools1.6.6affected
GetmeUKContentTools1.6.7affected
GetmeUKContentTools1.6.8affected
GetmeUKContentTools1.6.9affected
GetmeUKContentTools1.6.10affected
GetmeUKContentTools1.6.11affected
GetmeUKContentTools1.6.12affected
GetmeUKContentTools1.6.13affected
GetmeUKContentTools1.6.14affected
GetmeUKContentTools1.6.15affected
GetmeUKContentTools1.6.16affected

Weaknesses

  • CWE-79: Cross Site Scripting
  • CWE-94: Code Injection

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References