CVE-2025-71166

Typesetter CMS Reflected XSS via Move Message Handling

State: Published
Severity: 4.8 Medium
Published: Jan 14, 2026
Updated: Jul 14, 2026
Reserved: Jan 14, 2026

Description

Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status move message handling. The path parameter is reflected into the HTML output without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Affected Products

Product	Versions
TypesetterTypesetter	5.1 and earlierAffected

References

https://github.com/Typesetter/Typesetterproduct
https://github.com/Typesetter/Typesetter/issues/707issue-tracking
https://www.vulncheck.com/advisories/typesetter-cms-reflected-xss-via-move-message-handlingthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.