CVE-2025-13505CWE-79CWE-80cross-site-scripting

CVE-2025-13505

Medium · published December 2, 2025

CVSS v3.1
4.8
EPSS
0%
Percentile
9.5
In the wild
Unconfirmed
What it is

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Datateam Information Technologies Inc. Datactive allows Stored XSS.

This issue affects Datactive: from 2.13.34 before 2.14.0.6.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00201 · 9.5th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2025-12-02T20:15Z
Affected products (1)
ProductVersionsFixed in
datateam/datactive≥ 2.13.34, < 2.14.0.62.14.0.6
References (2)
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0424 · [email protected]https://www.usom.gov.tr/bildirim/tr-25-0424 · [email protected]
EPSS history
Timeline
  • 02 DEC 14:22Z
    Stored XSS in Datateam's Datactive
    cvelistv5