7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66468

CVE-2025-66468: Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors

Impact

Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled.

Workaround

If the standard CSP rules are active (default in production mode), an exploit isn't possible.

Credits

Lwin Min Oo lwinminoo2244@gmail.com

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66468

CVE-2025-66468:

7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
aimeos/ai-cms-grapesjs	composer	>= 2021.04.1, < 2021.10.8	2021.10.8
aimeos/ai-cms-grapesjs	composer	>= 2022.04.1, < 2022.10.9	2022.10.9
aimeos/ai-cms-grapesjs	composer	>= 2023.04.1, < 2023.10.15	2023.10.15
aimeos/ai-cms-grapesjs	composer	>= 2024.04.1, < 2024.10.8	2024.10.8
aimeos/ai-cms-grapesjs	composer	>= 2025.04.1, < 2025.10.2	2025.10.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue within the Aimeos GrapesJS CMS extension, exploitable by authenticated editors. The provided security advisory and commit patch point to a single commit that resolves the issue. The commit 2214f71ac27cdea25f11c8adf6bb5816db47a042 introduces a dependency on ezyang/htmlpurifier and modifies the fromArray function in src/Admin/JQAdm/Cms/Content/Standard.php. The changes in this function show that it now sanitizes the text.content value from the input data using HTMLPurifier. This indicates that the fromArray function was the point where the unsanitized, and potentially malicious, content was being processed and stored. Therefore, this function is the vulnerable function that would be present in a runtime profile when the vulnerability is triggered.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-66468: Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors

Impact

Workaround

Credits

CVE-2025-66468:

7.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Basic Information

Basic Information

7.7

7.7

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2025-66468: Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors

Impact

Workaround

Credits

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI