PT-2025-40241 · Issabel · Issabel
CVE-2025-40648
·
Publicado
2025-10-01
·
Atualizado
2025-10-01
CVSS v4.0
4.8
Média
| Vetor | AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions
Issabel version 5.0.0
Description
A stored Cross-Site Scripting (XSS) issue exists due to insufficient validation of user-supplied data. The issue is triggered through the
numero conferencia parameter in the '/index.php?menu=conferencia' API endpoint. This allows for the injection of malicious scripts that can be stored and executed by other users.Recommendations
Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict or sanitize input to the
numero conferencia parameter in the '/index.php?menu=conferencia' endpoint.Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Issabel