CVE-2025-15479CWE-79cross-site-scripting

CVE-2025-15479

Medium · published January 7, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms (

on Windows and Linux servers ) allows authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users’ browsers, steal session information and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00201 · 9.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-07T19:15Z
Affected products (1)
ProductVersionsFixed in
ngsurvey/ngsurvey< 3.6.173.6.17
References (2)
https://cds.thalesgroup.com/en/tcs-cert/CVE-2025-15479 · 64c5ae8f-7972-4697-86a0-7ada793ac795https://docs.ngsurvey.com/installation-setup/change-log#id-3.6.17-2025-05-28 · 64c5ae8f-7972-4697-86a0-7ada793ac795
EPSS history
Timeline
  • 07 JAN 13:23Z
    NGSurvey Enterprise 3.6.4 incorrect authorization exposes other users’ API keys and personal data
    cvelistv5