CVE-2025-67906

Summary

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.

Affected Software

Weaknesses

• CWE-79: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/franckferman/CVE-2025-67906

References

• https://github.com/MISP/MISP/commit/1f39deb572da7ecb5855e30ff3cc8cbcaa0c1054
• https://vulnerability.circl.lu/vuln/gcve-1-2025-0031
• https://github.com/franckferman/GCVE-1-2025-0030
• https://github.com/MISP/MISP/compare/v2.5.27…v2.5.28
• https://github.com/franckferman/CVE-2025-67906

• ←Previous
• Next→