CVE-2025-70960
A public proof of concept exists; no exploitation attested.
- Published2026-02-02
- WeaknessCWE-79
Am I affected?
Debian, Ubuntu or Red Hat sometimes backport a fix without changing the upstream version number: such a version reads « to verify », never « affected ».With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.
Description
A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
Timeline
dates in UTC- 2026-02-0223:16CVE publishedNVD
Versions per branch
OSV · NVD| Branch | Affected | Fixed in | Source |
|---|---|---|---|
| 15.3 | ≤ 15.3.7 | no fix published | OSV |
| 16.14 | ≤ 16.14 | no fix published | OSV |
| Branch | Affected | Fixed in | Source |
|---|---|---|---|
| 15.3 | = 15.3.7 | no fix published | NVD |
as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.
Fix
Advisories and patches
- github.comMitigation · Vendor Advisory
Detection
- Nuclei template
- none so far ProjectDiscovery
- Exploit-DB
- no entry Exploit-DB
- Proof of concept
- CISA-ADP (SSVC)PoC stated2026-02-03
- PoC-in-GitHubno public repository identifiedread 2026-11-08
- Metasploit modules
- none listed Metasploit Framework
Sources
- NVDCVE recordread 2026-10-23
- CISA-ADPSSVC decisionpoc2026-02-03
- CISA-ADPCVSS 3.15.42026-02-03
- CISA-ADPweakness (CWE)CWE-792026-02-03
- FIRST EPSSEPSS score0.3 %2026-11-08
- OSVaffected packages—
- GitHub AdvisoriesadvisoryMODERATE2026-06-10
Identifiers
- EUVD-2025-206766same flawENISA EUVD · LicenseRef-ENISA-legal-notice
- GHSA-6fvp-wmh6-jg95same flawGitHub Advisory Database · CC-BY-4.0
- PYSEC-2026-138same flawPyPA Advisory Database · CC-BY-4.0
Technical details
- CVSS v3 Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Published
- 2026-02-02
- Last Modified
- 2026-06-17
- NVD status
- Analyzed
- GitHub Advisory
- GHSA-6fvp-wmh6-jg95
Frequently asked questions
What is CVE-2025-70960?
Is CVE-2025-70960 actively exploited?
What is the CVSS score for CVE-2025-70960?
Running tendenci? Hear about its next vulnerability
Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».
No credit card required · No monthly cap on website lookups · 250 API requests/month
Go further
- Following what attackers exploit right now? The CISA KEV additions of the month, with their patch deadlines.
- Running this software? Vulnerability monitoring alerts you to new vulnerabilities in your products.
Related vulnerabilities
Same product first, then the same vendor advisory and the same publication week.
- CVE-2020-36962same productTendenci 12.3.1 - CSV/ Formula Injection
- CVE-2026-23946same productTendenci has Authenticated Remote Code Execution via Pickle Deserialization
- CVE-2025-70959same product
- CVE-2026-21643KEVsame weekSQL Injection Vulnerability in FortiClientEMS 7.4.4 Allows Unauthenticated Remote Code Execution
- CVE-2026-1731KEVsame weekRemote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
- CVE-2025-15556KEVsame week
- CVE-2026-0599same week
- CVE-2026-25512same week
Sources for this record
- CVE Program · CVE Program Terms of Use
- ENISA EU Vulnerability Database · ENISA legal notice §1.2 (reproduction authorised, provided the source is acknowledged)
- FIRST EPSS · EPSS terms of use (free use, attribution requested)
- GitHub Advisory Database · CC-BY-4.0 · GHSA-6fvp-wmh6-jg95
- NVD · Public domain (17 U.S.C. § 105) for NVD-authored data; third-party content under its own terms
- OSV.dev · Per record, as its publisher states it: each row carries the label in sourceLicense when one is served
- CISA Vulnrichment · CC0-1.0