Tendenci CMS contains a stored Cross-site Scripting (XSS) vulnerability in the Forums module

中危 5.4CVE-2025-70960 · GHSA-6fvp-wmh6-jg95 · PYSEC-2026-138 · Published 02/02/2026 · updated 17/06/2026

要点

CVE-2025-70960 是影响 tendenci, tendenci (tendenci) 的中危 (CVSS 5.4)漏洞。
未来 30 天内被利用的概率（EPSS）：0.27%，高于 19.2% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
tendenci PyPI	`≤ 15.3.7≤ 16.14`	No fix yet
tendenci tendenci	`= 15.3.7`	No fix yet

Description

A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

NVD description

A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

References

nvd.nist.gov/vuln/detail/CVE-2025-70960 · ADVISORY
emirhanyucelll/tendenci · WEB
tendenci/tendenci · PACKAGE
GitHub Advisory GHSA-6fvp-wmh6-jg95 · ADVISORY

tendenci 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

tendenci

PyPI

≤ 15.3.7≤ 16.14

No fix yet

tendenci

= 15.3.7

No fix yet

Description

A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

NVD description

A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

tendenci 的其他漏洞

查看全部 →