关键漏洞信息 CVE ID: CVE-2025-67443 Summary: Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS) due to lack of JavaScript sanitization in the login form. Affected Product / Versions: - Vendor: Schlix - Project / Repo: https://www.schlix.com/ - Affected Version: Before v2.2.9-5 - Fixed in: v2.2.9-5 Vulnerability Type: Cross Site Scripting (Stored XSS) - CWE-79 Attack Type: Remote; The admin needs to access the login attempt logs page. Impact: Cross Site Scripting may cause session hijacking, credential disclosure via stolen cookies/localStorage, phishing, or forced actions. Attack Vector: An attacker crafts a URL containing the malicious payload in the 'name' path segment (e.g., /author/) and lures a victim to click on it. References: Schlix CMS release (patch): Link Vendor Confirmation: The vendor released a patch (v2.2.9-5) that addresses this issue. Mitigation / Remediation: Apply the vendor-supplied patch (upgrade to v2.2.9-5). Discoverer: Akiner Kisa