CVE-2025-9433 MEDIUM

CVE-2025-9433: mtons mblog Admin Panel list cross site scripting

Vendor Mtons
Product mblog
Weakness CWE-79 · XSS
Published August 26, 2025
Last update August 26, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in mtons mblog up to 3.5.0. The impacted element is an unknown function of the file /admin/user/list of the component Admin Panel. Performing manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.

Key dates

02Disclosure timeline

August 26, 2025 CVE published
August 26, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-68856 WordPress Mopinion Feedback Form plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-3671 Print-O-Matic <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-22856 Stored cross-site scripting in BlogEngine.NET version 3.3.8.0 CVE-2024-10242 Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection CVE-2021-32641 Reflected XSS when using flashMessages