PT-2026-43584
CVE-2025-13167
·
Published
2026-05-27
·
Updated
2026-10-07
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Synology Contacts versions prior to 1.0.10-20659
Description
Improper neutralization of input during web page generation leads to a Cross-site Scripting (XSS) issue in the contact functionality. This allows remote authenticated users to read or write specific files containing non-sensitive information via unspecified vectors.
Recommendations
Update to version 1.0.10-20659 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾