CVE-2025-51487: Moonshine

Medium severity, CVSS 4.5. EPSS: 0.4% chance of exploitation in the next 30 days.

A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.5, allowing to execute arbitrary JavaScript by using "javascript:" payload, instead of the expected HTTPS protocol, in the CutCode Link parameter when creating/updating a new Article.

Affected products

• Moonshine Moonshine: before 3.12.5 (fixed in 3.12.5)

Published 2025-08-19. Last modified 2026-06-17.