4.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-51487

CVE-2025-51487: moonshine Stored Cross-Site Scripting Vulnerability in Create Article

A stored cross-site scripting (XSS) vulnerability in the Create Article function of MoonShine v3.12.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Link parameter.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-51487

CVE-2025-51487:

4.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moonshine/moonshine	composer	< 3.12.4	3.12.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue within the MoonShine admin panel, primarily affecting the 'Create Article' functionality via a malicious 'Link' parameter. The root cause is the failure to properly sanitize user-provided input before rendering it in HTML.

The investigation of the patch commit f108f4ea5c0d66e8172c2dc397c1d9a6f466d9c6 reveals several points where output escaping was missing. The most critical functions identified are:

MoonShine\UI\Components\Link::prepareBeforeRender: This is the core of the vulnerability. This function constructs a link but failed to escape the href attribute, allowing an attacker to inject a javascript: payload, which would be executed when a user clicks the link.
MoonShine\UI\Fields\Url::resolvePreview: This function is responsible for displaying the stored URL. It uses the Link component to render the output. An attacker could save a malicious script as a URL, and this function would render it on the page, leading to stored XSS.

The patch addresses these issues by consistently applying htmlspecialchars to values that are rendered in HTML attributes or as content. The fix also extends to other, similar vulnerabilities in related-data fields (BelongsTo, MorphTo) and select options, indicating a broader effort to harden the application against XSS. Any of these functions could appear in a runtime profile during an exploit, as they are all involved in processing and rendering potentially malicious data.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.