Aggregates CVE and security vulnerability intelligence across all jupo-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Disclosed issues often relate to vendor risk cross-site scripting; exposure may include vendor impact session compromise in vendor surface production workloads and vendor surface software deployment contexts.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2025-50481 | A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a blog post. | [email protected] | 4.8 | 0.55% | 2025-07-23 | 2025-07-28 |
| CVE-2025-6050 | Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/adm | 596c5446-0ce5-4ba2-aa66-48b3b757a647 | 4.8 | 0.26% | 2025-06-17 | 2025-07-30 |
| CVE-2025-29573 | Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module. | [email protected] | 6.1 | 0.18% | 2025-05-05 | 2025-06-16 |
| CVE-2024-25170 | An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header. | [email protected] | 9.1 | 0.87% | 2024-02-28 | 2025-04-28 |
| CVE-2024-25169 | An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request. | [email protected] | 9.8 | 1.05% | 2024-02-28 | 2025-03-28 |
| CVE-2020-19002 | Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632. | [email protected] | 6.1 | 1.08% | 2021-08-27 | 2024-11-21 |
| CVE-2018-16632 | Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/. | [email protected] | 4.8 | 0.61% | 2018-12-28 | 2024-11-21 |