PT-2025-40985 · Unknown · Biobanking/Biomolecular Resources Negotiator
CVE-2025-40649
·
Publicado
2025-10-07
·
Atualizado
2025-10-07
CVSS v4.0
5.1
Média
| Vetor | AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions
Biobanking and Biomolecular Resources Negotiator version 3.15.2
Description
A stored Cross-Site Scripting (XSS) issue exists due to insufficient validation of user-supplied data. A remote user can exploit this by sending a POST request with a crafted payload through the
text parameter in the '/api/v3/negotiations//posts' API endpoint. Successful exploitation could allow an attacker to steal the cookie session details of an authenticated user.Recommendations
Update Biobanking and Biomolecular Resources Negotiator to a version that addresses this issue.
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Biobanking/Biomolecular Resources Negotiator