← Vulnerability feed

Vulnerability record · CVE-2025-14013 · published 4 December 2025

CVE-2025-14013: Jizhicms cross-site scripting vulnerability

JJizhicms · Jizhicms

A vulnerability was identified in JIZHICMS up to 2.5.5. The impacted element is an unknown function of the file /index.php/admins/Comment/addcomment.html of the component Comment Handler. The manipulation of the argument body leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

1.9 CVSS 4.0 Low EPSS 0.28% · top 80.9% CWE-79 · Cross-site scriptingCWE-94 · Code injection
1.9CVSS 4.0 base score, v2 3.3
0.28%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

A vulnerability was identified in JIZHICMS up to 2.5.5. The impacted element is an unknown function of the file /index.php/admins/Comment/addcomment.html of the component Comment Handler. The manipulation of the argument body leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/24-2021/vul2/blob/main/jizhicms%3DV2.5.5-Commentaddcomment.html-bodyparameter-Storage%20XSS/jizhicms% ExploitThird Party Advisory
https://vuldb.com/?ctiid.334254 Permissions RequiredVDB Entry
https://vuldb.com/?id.334254 Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.694649 Third Party AdvisoryVDB Entry

Track CVE-2025-14013 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-50229Jizhicms sql injection vulnerabilityJizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.EPSS 0.36%9.8CVE-2025-25784Jizhicms unrestricted file upload vulnerabilityAn arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via u…EPSS 0.92%9.8CVE-2024-32161Jizhicms unrestricted file upload vulnerabilityjizhiCMS 2.5 suffers from a File upload vulnerability.EPSS 0.72%9.8CVE-2023-51154Jizhicms information exposure vulnerabilityJizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php.EPSS 0.61%9.8CVE-2023-2927Jizhicms server-side request forgery (ssrf) vulnerabilityA vulnerability was found in JIZHICMS 2.4.5. It has been classified as critical. Affected is the function index of the file TemplateController.php. T…EPSS 0.87%9.8CVE-2021-36484Jizhicms sql injection vulnerabilitySQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page.EPSS 0.85%9.8CVE-2022-36578Jizhicms sql injection vulnerabilityjizhicms v2.3.1 has SQL injection in the background.EPSS 0.93%9.8CVE-2022-27429Jizhicms server-side request forgery (ssrf) vulnerabilityJizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html.EPSS 1.2%

Source: NIST National Vulnerability Database (record CVE-2025-14013), CISA KEV, FIRST EPSS (scores of 2026-10-14). This page is refreshed as NVD updates the record.