CVE-2025-51488: Moonshine

Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days.

A Stored Cross-Site Scripting (XSS) vulnerability exists in MoonShine version < 3.12.4, allowing remote attackers to store and execute arbitrary JavaScript by including a malicious HTML payload in the Name parameter when creating a new Admin.

Affected products

• Moonshine Moonshine: before 3.12.5 (fixed in 3.12.5)

Published 2025-08-19. Last modified 2026-06-17.