{"id":"CVE-2025-52037","details":"A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08), and was fixed in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (dated 2025-03-31). The attack can be launched remotely. CWE Definition of the Vulnerability: CWE-79.","modified":"2026-10-28T02:31:08.235500983Z","published":"2025-08-26T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52037.json"},"references":[{"type":"WEB","url":"https://gist.github.com/yA0-Z/eb6cd89398abff716c70866fa873dbde"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52037.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52037"},{"type":"REPORT","url":"https://github.com/PrivateAccount/NotesCMS/issues/3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/privateaccount/notescms","events":[{"introduced":"0"},{"fixed":"95322c5121dbd7070f3bd54f2848079654a0a8ea"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"95322c5121dbd7070f3bd54f2848079654a0a8ea"}],"source":"DESCRIPTION"},{"source":"DESCRIPTION","range":[{"introduced":"0"},{"last_affected":"95322c5121dbd7070f3bd54f2848079654a0a8ea"}]}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52037.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}