CVE-2025-10348CWE-79cross-site-scripting

CVE-2025-10348

published October 30, 2025

CVSS
5.1
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

URVE Smart Office is vulnerable to Stored XSS in report problem functionality. An attacker with a low-privileged account can upload an SVG file containing a malicious payload, which will be executed when a victim visits the URL of the uploaded resource. The resource is available to anyone without any form of authentication.

This issue was fixed in version 1.1.24.

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00353 · 27.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-30T17:15Z
References (2)
https://cert.pl/posts/2025/10/CVE-2025-10348 · [email protected]https://smartoffice.expert/ · [email protected]
EPSS history
Timeline
  • 30 OCT 13:00Z
    Stored Cross-Site Scripting in URVE Smart Office
    cvelistv5