CVE-2025-4379: Studio Fabryka Dobrycms

Medium severity, CVSS 5.1. EPSS: 0.5% chance of exploitation in the next 30 days.

DobryCMS in versions 2.* and lower is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in szukaj parameter allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened. A hotfix for affected versions was released on 29.04.2025. It removes the vulnerability without incrementing the version.

Affected products

• Studio Fabryka Dobrycms: before 3 (fixed in 3)

Published 2025-05-23. Last modified 2026-06-17.