PT-2025-34776
CVE-2025-52035
·
Published
2025-08-26
·
Updated
2025-09-17
Description by
CVSS 3.1
6.1
MediumMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
NotesCMS versions prior to commit 95322c5121dbd7070f3bd54f2848079654a0a8ea
Description:
A vulnerability exists in NotesCMS, specifically within the
/index.php?route=notes page. Manipulation of the title of service descriptions leads to a stored cross-site scripting (XSS) issue. The vulnerability was confirmed to be present as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08). The attack can be launched remotely.Recommendations:
Update NotesCMS to commit 95322c5121dbd7070f3bd54f2848079654a0a8ea or a later version to resolve this issue.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾