CVE-2025-55287
MEDIUMkreaweb genealogy < 4.4.0 - Authenticated Stored Cross-Site Scripting
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-55287. PoCs published by Eternalvalhalla.
AI-analyzed exploit summary This PoC demonstrates an authenticated stored XSS vulnerability in a Genealogy app (versions prior to 4.4.0) where an attacker with Editor+ privileges can inject malicious JavaScript into a person's firstname/lastname field. When a higher-privileged user deletes the person, the script executes, sending a CSRF token and snapshot data to add the attacker as an Administrator via a Livewire component update.
Description
Genealogy is a family tree PHP application. Prior to 4.4.0, Authenticated Stored Cross-Site Scripting (XSS) vulnerability was identified in the Genealogy application. Authenticated attackers could run arbitrary JavaScript in another user’s session, leading to session hijacking, data theft, and UI manipulation. This vulnerability is fixed in 4.4.0.
Exploits (1)
This PoC demonstrates an authenticated stored XSS vulnerability in a Genealogy app (versions prior to 4.4.0) where an attacker with Editor+ privileges can inject malicious JavaScript into a person's firstname/lastname field. When a higher-privileged user deletes the person, the script executes, sending a CSRF token and snapshot data to add the attacker as an Administrator via a Livewire component update.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N