A HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject arbitrary web script or HTML via the text parameter of add_project_comment function.
References
| Link | Resource |
|---|---|
| https://github.com/Sunnyshineshow/vulnerability-research/blob/main/CVE-2025-51962/CVE-2025-51962.md | Third Party Advisory |
| https://github.com/pmgl/microstudio/ | Product |
Configurations
History
02 Jan 2026, 14:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:microstudio:microstudio:24.01.29:*:*:*:*:*:*:* | |
| References | () https://github.com/Sunnyshineshow/vulnerability-research/blob/main/CVE-2025-51962/CVE-2025-51962.md - Third Party Advisory | |
| References | () https://github.com/pmgl/microstudio/ - Product | |
| First Time |
Microstudio microstudio
Microstudio |
16 Dec 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
15 Dec 2025, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-15 19:16
Updated : 2026-01-02 14:43
NVD link : CVE-2025-51962
Mitre link : CVE-2025-51962
CVE.ORG link : CVE-2025-51962
JSON object : View
Products Affected
microstudio
- microstudio
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')