Dashboard / CVE-2025-60936

CVE-2025-60936

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 62/100
Published: 2025-10-24 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Required
S: Changed
C: Low
I: Low
A: None

Description

Emoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism. This vulnerability allows authenticated attackers with API access to inject malicious JavaScript code that executes when administrators view the application logs.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
openenergymonitor emoncms 11.7.3

References & Advisories (1)

https://github.com/emoncms/emoncms/issues/1940
Exploit Issue Tracking Third Party Advisory

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

6.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS — Exploitation Probability

0.19%
Raw Score 0.001950
Percentile 9.3%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00195
2026-11-12
0.00195
2026-11-10
0.00195
2026-11-09
0.00195
2026-11-08
0.00195
2026-11-07
0.00195
2026-11-06
0.00195
2026-11-05
0.00195

Intelligence Sources

nvd ref →

External Links