NukeViet CMS versions 4.5.07 and prior contain a stored cross‑site scripting flaw that arises when server‑side input sanitization in the Request class is insufficient. The CMS relies mainly on client‑side filtering, allowing an attacker to bypass these checks by modifying HTTP traffic with a proxy such as Burp Suite. By injecting malicious payloads that are then stored, any user who views the affected content—including administrators, moderators, and other visitors—will execute the injected code in their browser. This can lead to session hijacking through cookie theft, unauthorized actions carried out under the victim’s identity, site defacement, redirection to phishing sites, and manipulation of email notifications.

NukeViet CMS v4.5.07 and earlier are affected. The vulnerability is fixed in version 4.5.08, so any deployment running 4.5.07 or earlier should be upgraded or otherwise remediated.

The CVSS score of 8.7 indicates a high‑severity vulnerability, and although no EPSS score is available, the lack of required authentication combined with the ability to use any anonymous visitor to submit malicious content makes exploitation straightforward. The vulnerability is not yet listed in CISA’s KEV catalog, but the attack path—remote HTTP request manipulation and stored payload execution—is well understood and can be carried out with common web‑intercept tools. Administrators should therefore consider the vulnerability a high‑risk threat until a patch or vendor‑approved workaround is in place.