4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-51488

CVE-2025-51488: moonshine Stored Cross-Site Scripting Vulnerability in Create Admin

A stored cross-site scripting (XSS) vulnerability in the Create Admin function of MoonShine v3.12.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-51488

CVE-2025-51488:

4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moonshine/moonshine	composer	< 3.12.4	3.12.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue originating from the 'Create Admin' function, where the 'Name' parameter is not properly sanitized before being stored. The core of the vulnerability lies in how this stored data is later rendered in the UI. The provided patch, commit f108f4ea5c0d66e8172c2dc397c1d9a6f466d9c6, addresses the issue at the rendering stage by applying HTML escaping in multiple components.

The analysis of the patch reveals several key areas where unescaped data was being displayed:

Relationship Fields (BelongsTo, MorphTo): The resolvePreview methods in these fields would display data from related models (such as an admin's name) without escaping, making them a primary vector for the stored XSS.
Select Options (Option DTO): The getLabel and getValue methods returned raw data. When a list of admins is rendered in a dropdown, a malicious name would be rendered as HTML, executing the script.
Links (Link component, WithLink trait): The href attribute and link values were not escaped, allowing for javascript: payloads.

The identified vulnerable functions are the specific methods responsible for rendering this data. During an exploit, after an attacker has injected a malicious payload into an admin's name, these functions would be called when any page attempts to display that name, triggering the XSS. The patch mitigates this by consistently applying htmlspecialchars to the output of these functions, ensuring that any stored malicious scripts are rendered as inert text rather than being executed by the browser.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.