Silverstripe vulnerabilities April 2025

Author: emteknetnz

dnadesign/silverstripe-elemental/CVE-2025-25197.yaml

@@ -0,0 +1,8 @@
+title:     "CVE-2025-25197 - XSS attack in elemental \"Content blocks in use\" report"
+link:      https://www.silverstripe.org/download/security-releases/cve-2025-25197
+cve:       CVE-2025-25197
+branches:
+    5.3.x:
+        time:     2025-10-04 02:37:11
+        versions: ['<5.3.12']
+reference: composer://dnadesign/silverstripe-elemental

silverstripe/framework/CVE-2025-30148.yaml

@@ -0,0 +1,8 @@
+title:     "CVE-2025-30148 - XSS vulnerability in HTML editor"
+link:      https://www.silverstripe.org/download/security-releases/cve-2025-30148
+cve:       CVE-2025-30148
+branches:
+    5.3.x:
+        time:     2025-10-04 02:37:11
+        versions: ['<5.3.23']
+reference: composer://silverstripe/framework

silverstripe/framework/SS-2025-001.yaml

@@ -0,0 +1,8 @@
+title:     "SS-2025-001 - User enumeration via timing attack"
+link:      https://www.silverstripe.org/download/security-releases/ss-2025-001
+cve:       ~
+branches:
+    5.3.x:
+        time:     2025-10-04 02:37:11
+        versions: ['<5.3.23']
+reference: composer://silverstripe/framework