CVE-2025-65868
Published: 03 December 2025
Description
XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST request.
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of information inputs, directly preventing XXE injection by rejecting or sanitizing crafted XML payloads in POST requests.
SC-5 protects against denial-of-service events like resource exhaustion from XXE entity expansion attacks.
SI-2 ensures timely remediation of flaws such as the XML parsing vulnerability in eyoucms v1.7.1.
Security SummaryAI
CVE-2025-65868 is an XML external entity (XXE) injection vulnerability, mapped to CWE-611, affecting eyoucms version 1.7.1. Published on 2025-12-03, it allows remote attackers to trigger a denial of service condition by sending a POST request with a specially crafted body that exploits improper XML parsing.
The vulnerability carries a CVSS v3.1 base score of 7.5 (High), with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Any unauthenticated attacker with network access can exploit it with low attack complexity and no user interaction, achieving high-impact disruption to availability while leaving confidentiality and integrity unaffected.
Details on the vulnerability are reported in GitHub issue #66 on the eyoucms repository (https://github.com/weng-xianhu/eyoucms/issues/66). No specific patch or mitigation guidance is detailed in the provided references.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XXE vulnerability in public-facing web application enables denial of service via application exploitation.