Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2025-48918: Simple Klaro lets attackers inject malicious code
CVE-2025-48918 · published 1 year ago
Summary
The Simple Klaro module can be tricked into inserting harmful script into web pages, which could allow an attacker to steal information or hijack user sessions. This happens because the module does not properly clean user-supplied data before showing it. Update Simple Klaro to version 1.10.0 or newer, and apply any vendor-recommended patches to protect your site.
What to do
- Update 1xinternet simple_klaro to version 1.10.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| 1xinternet | simple_klaro |
< 1.10.0 cpe:2.3:a:1xinternet:simple_klaro:*:*:*:*:*:drupal:*:* |
Original advisory text
Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.
References
- https://www.drupal.org/sa-contrib-2025-071 URL
- https://git.drupalcode.org/project/simple_klaro URL
- https://www.drupal.org/project/simple_klaro URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48918... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-48918 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published13 Jun 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta