Raw vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2025-65961 is a low-severity Improper Neutralization of Alternate XSS Syntax (CWE-87) vulnerability in Contao Contao. Its CVSS base score is 3.3 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-199631
Vulnerability Data
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back…
more
end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves not using the affected templates or patch them manually.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.2V1.3.2
Mitigating Controls (NIST 800-53 r5) AI
SA-11 requires developer testing and analysis that can discover improper neutralization of alternate script syntax after it has been coded.
SI-10 directly requires validation/sanitization of untrusted inputs, which structurally stops alternate XSS syntax from reaching the interpreter.
Output filtering can catch or sanitize unneutralized script content before it is served to users.
SA-8 mandates secure engineering principles such as input neutralization and output encoding that prevent introduction of this class of flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input neutralization and output encoding to prevent alternate XSS syntax.
Patching and EOL replacement can remediate known XSS instances in libraries or frameworks (partial) but do nothing to enforce input neutralization in application code (none).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards require proper neutralization of alternate script syntax, directly eliminating CWE-87.
Security testing catches residual XSS but does not itself implement the neutralization controls.
Knowledge exchange on emerging attack techniques and patches reduces the likelihood that cross-site scripting flaws remain unaddressed in deployed applications.
Operational indicators of compromise for web-application attacks can be incorporated into WAF or input-filtering rules, lowering the likelihood that unsanitized data reaches the browser.
Secure SDLC mandates input validation and output encoding that directly prevent alternate XSS syntax.
Application security requirements explicitly call for neutralization of untrusted input to block XSS variants.