PT-2025-40369

CVE-2025-59748

·

Published

2025-09-19

·

Updated

2026-10-12

Description by

CVSS 4.0
6.9
Medium
MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions AndSoft e-TMS version 25.03
Description A cross-site scripting (XSS) issue exists that allows an attacker to execute JavaScript code in a victim’s browser. This is achieved by sending a malicious URL. The vulnerability is reflected through the l and reset parameters in the '/clt/changepassword.asp' API endpoint.
Recommendations Apply a fix for AndSoft e-TMS version 25.03 to address the reflected cross-site scripting issue in the '/clt/changepassword.asp' endpoint.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2025-59748
BDU:2025-12699
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com