Medium severity · published Dec 10, 2025
CVE-2024-58285
Chyrp 2.5.2 Stored Cross-Site Scripting Vulnerability via Post Title
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can craft payloads in the title field that will execute when the post is viewed by other users, potentially stealing session cookies or performing client-side attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chyrp · chyrp
2.5.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-58285
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-58285
Product
https://github.com/chyrp/
Release Notes
https://github.com/chyrp/chyrp/archive/refs/tags/v2.5.2.zip
Exploit
https://www.exploit-db.com/exploits/52013
Third Party Advisory
https://www.vulncheck.com/advisories/chyrp-stored-cross-site-scripting-vulnerability-via-post-title
More from Chyrp
7.5
CVE-2025-69768
SQL Injection vulnerability in Chyrp v.2.5.2 and before allows a remote attacker to obtain sensitive information via the Admin.php component
6.1
CVE-2012-1001
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the (1) content…
–
CVE-2014-7264
Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1…
–
CVE-2011-2745
upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote…
–
CVE-2011-2780
Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a