CVE-2025-13589CWE-79cross-site-scripting

CVE-2025-13589

published November 24, 2025

CVSS

5.1

EPSS

Percentile

37.3

In the wild

Unconfirmed

What it is

FMS developed by Otsuka Information Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.

The record

Technical detail

CVSS: 5.1 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00442 · 37.3th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2025-11-24T09:15Z

References (2)

https://www.twcert.org.tw/en/cp-139-10521-abdc1-2.html · [email protected]https://www.twcert.org.tw/tw/cp-132-10520-03f29-1.html · [email protected]

EPSS history

Timeline

24 NOV 03:09Z
Otsuka Information Technology｜FMS - Reflected Cross-site Scripting
cvelistv5