CVE-2025-67906

Description

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.

PUBLISHED Reserved 2025-12-15 | Published 2025-12-15 | Updated 2025-12-21 | Assigner mitre

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

References

github.com/franckferman/CVE-2025-67906 exploit

github.com/...ommit/1f39deb572da7ecb5855e30ff3cc8cbcaa0c1054

vulnerability.circl.lu/vuln/gcve-1-2025-0031

github.com/franckferman/GCVE-1-2025-0030

github.com/MISP/MISP/compare/v2.5.27...v2.5.28

github.com/franckferman/CVE-2025-67906

cve.org (CVE-2025-67906)

nvd.nist.gov (CVE-2025-67906)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.