CVE-2025-55287

Genealogy is a family tree PHP application. Prior to 4.4.0, Authenticated Stored Cross-Site Scripting (XSS) vulnerability was identified in the Genealogy application. Authenticated attackers could run arbitrary JavaScript in another user’s session, leading to session hijacking, data theft, and UI manipulation. This vulnerability is fixed in 4.4.0.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v3.0

8.0 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

0.32% chance of exploitation in the next 30 days, 25th percentile

Published

2025-08-18

Proof-of-concept exploits (1)

• Eternalvalhalla/CVE-2025-55287-POC1★ · 2025-08-21

References

• CVE Record
• NVD entry

Related

• CVE-2025-5527
• CVE-2025-55296
• CVE-2025-5526
• CVE-2025-55298
• CVE-2025-5525
• CVE-2025-55303