Platform
php
Component
cve_article
Fixed in
2.0.6
CVE-2025-2340 is a cross-site scripting (XSS) vulnerability affecting Tale Blog versions 2.0.5–2.0.5. This vulnerability allows attackers to inject malicious scripts into the application, potentially leading to session hijacking or data theft. The vulnerability resides in the saveOptions function within the /options/save file of the Site Settings component. A fix is available in version 2.0.6.
An attacker can exploit this XSS vulnerability by manipulating the 'Site Title' parameter within the /options/save endpoint. Successful exploitation allows the attacker to inject arbitrary JavaScript code into the Tale Blog application. This code will then execute in the context of any user visiting the affected page, potentially enabling the attacker to steal session cookies, redirect users to malicious websites, or deface the website. Given the publicly disclosed nature of this vulnerability, it presents a significant risk, especially since the product is no longer supported by the maintainer, leaving it vulnerable to ongoing attacks.
This vulnerability has been publicly disclosed, increasing the likelihood of exploitation. The lack of response from the vendor and the product's unsupported status further exacerbate the risk. While no active exploitation campaigns have been publicly reported, the availability of a proof-of-concept significantly lowers the barrier to entry for attackers. The vulnerability was disclosed on 2025-03-16.
Exploit Status
EPSS
0.09% (25% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-2340 is to upgrade Tale Blog to version 2.0.6, which contains the fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious characters in the 'Site Title' parameter. Input validation on the server-side, specifically sanitizing user-supplied data before rendering it in the HTML, can also help prevent XSS attacks. Since the product is no longer supported, thorough security audits and ongoing monitoring are crucial.
Given that the product is no longer supported, the only solution is to migrate to a supported platform or version that has corrected the XSS vulnerability. If this is not possible, it is recommended to disable the affected component or implement additional security measures, such as input filtering and output encoding, to mitigate the risk.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-2340 is a cross-site scripting (XSS) vulnerability in Tale Blog versions 2.0.5–2.0.5, allowing attackers to inject malicious scripts.
You are affected if you are running Tale Blog version 2.0.5 and have not upgraded to version 2.0.6.
Upgrade Tale Blog to version 2.0.6. If upgrading is not possible, implement a WAF rule to filter suspicious input.
While no active campaigns are confirmed, the vulnerability is publicly disclosed, increasing the risk of exploitation.
Due to the product being unsupported, there is no official advisory. Refer to external security resources for information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.