CVE-2025-67163 - Vulnerability Details - OpenCVE

A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Forum Name parameter.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation poc

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://github.com/SimpleMachines/SMF
https://github.com/SimpleMachines/SMF/blob/release-3.0/Themes/default/Stats.template.php#L26
https://github.com/SimpleMachines/SMF/security/advisories/GHSA-p2xm-x9fp-5r7x
https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67163
https://wiki.simplemachines.org/smf/Installing

History

Thu, 18 Dec 2025 21:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-79 CWE-83
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 18 Dec 2025 20:15:00 +0000

Type	Values Removed	Values Added
Description		A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Forum Name parameter.
References		https://github.com/SimpleMachines/SMF https://github.com/SimpleMachines/SMF/blob/release-3.0/Themes/default/Stats.template.php#L26 https://github.com/SimpleMachines/SMF/security/advisories/GHSA-p2xm-x9fp-5r7x https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67163 https://wiki.simplemachines.org/smf/Installing

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-12-18T00:00:00.000Z

Updated: 2025-12-18T20:25:25.031Z

Reserved: 2025-12-08T00:00:00.000Z

Link: CVE-2025-67163

Vulnrichment

Updated: 2025-12-18T20:24:34.402Z

NVD

Status : Received

Published: 2025-12-18T20:16:08.067

Modified: 2025-12-18T21:15:57.603

Link: CVE-2025-67163

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-67163", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-12-18T20:25:25.031Z", "dateReserved": "2025-12-08T00:00:00.000Z", "datePublished": "2025-12-18T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-12-18T20:10:54.305Z"}, "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Forum Name parameter."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/SimpleMachines/SMF/security/advisories/GHSA-p2xm-x9fp-5r7x"}, {"url": "https://github.com/SimpleMachines/SMF/blob/release-3.0/Themes/default/Stats.template.php#L26"}, {"url": "https://github.com/SimpleMachines/SMF"}, {"url": "https://wiki.simplemachines.org/smf/Installing"}, {"url": "https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67163"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-83", "lang": "en", "description": "CWE-83 Improper Neutralization of Script in Attributes in a Web Page"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-12-18T20:23:58.851826Z", "id": "CVE-2025-67163", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T20:25:25.031Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-67163", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-18T20:23:58.851826Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-83", "description": "CWE-83 Improper Neutralization of Script in Attributes in a Web Page"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T20:24:34.402Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/SimpleMachines/SMF/security/advisories/GHSA-p2xm-x9fp-5r7x"}, {"url": "https://github.com/SimpleMachines/SMF/blob/release-3.0/Themes/default/Stats.template.php#L26"}, {"url": "https://github.com/SimpleMachines/SMF"}, {"url": "https://wiki.simplemachines.org/smf/Installing"}, {"url": "https://github.com/mbiesiad/vulnerability-research/tree/main/CVE-2025-67163"}], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Forum Name parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-12-18T20:10:54.305Z"}}}, "cveMetadata": {"cveId": "CVE-2025-67163", "state": "PUBLISHED", "dateUpdated": "2025-12-18T20:25:25.031Z", "dateReserved": "2025-12-08T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-12-18T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}