CVE-2025-64112 — Statmatic vulnerable to Stored Cross-Site Scripting
Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation …
Published: 2025-10-30 · CVSS: 8.0 · CVSS 3.1
Statmatic is a Laravel and Git powered content management system (CMS). Stored XSS vulnerabilities in Collections and Taxonomies allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users. This vulnerability is fixed in 5.22.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7