CVE-2022-25489

Deeper analysis

Atom CMS version 2.0 contains a reflected cross-site scripting vulnerability in the debug.php widget, where the "A" parameter is not properly sanitized before being reflected in responses. The flaw is tracked as CWE-79 and carries a CVSS 3.1 score of 5.4, reflecting network attack vector, low attack complexity, and the requirement for an authenticated session.

An authenticated attacker can supply a crafted value for the "A" parameter that executes arbitrary script in the browser of another user who follows the resulting link. Successful exploitation yields limited impacts on confidentiality and integrity within the affected CMS context, with the changed scope indicating the script can affect resources beyond the immediate application origin.

The EPSS score for this CVE rose from a low baseline to a recorded peak of 0.0848 before settling at the current value of 0.0539, indicating measurable post-disclosure interest in exploitation. The only public references are GitHub issue threads that document the finding but contain no vendor-supplied patches or mitigation guidance.