CVE-2025-51488: MoonShine Stored Cross-Site Scripting Vulnerability in Create Admin
Summary
CVE-2025-51488: moonshine Stored Cross-Site Scripting Vulnerability in Create Admin. Affects moonshine/moonshine versions < 3.12.14. Fixed in 3.12.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoonShine is a popular PHP package designed for building admin panels quickly and efficiently. It provides developers with a robust framework for creating user-friendly interfaces and managing backend functionalities. However, like many web applications, it is susceptible to security vulnerabilities, particularly those related to user input handling.
Vulnerability Detail
A stored cross-site scripting (XSS) vulnerability exists in the Create Admin function of MoonShine version 3.12.3. This vulnerability allows attackers to inject malicious scripts into the Name parameter, which can then be executed in the context of other users' browsers. The implications of this vulnerability are significant, as it can lead to unauthorized actions, data theft, and a compromised user experience. The vulnerability is categorized under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Minimum fixed version
3.12.14
This is the first release that contains the fix.
composer require moonshine/moonshine:3.12.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can sanitize user inputs to prevent the execution of malicious scripts. Implementing input validation and escaping output can help mitigate the risk until the package is updated. For example, ensure that any user input is properly encoded before being rendered in the browser.
Conclusion
The stored cross-site scripting vulnerability in MoonShine poses a significant risk to applications using affected versions. It is crucial to update to the patched version to ensure the security of your application and protect users from potential attacks.
See every vulnerability recorded for moonshine/moonshine →
FAQ
The vulnerability is a stored cross-site scripting (XSS) issue that allows attackers to inject malicious scripts into the application.
Versions of MoonShine prior to 3.12.4 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If exploited, this vulnerability can lead to unauthorized actions, data theft, and a compromised user experience for affected users.
The CVSS score of this vulnerability is 4.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for moonshine/moonshine.
