CVE-2025-35996CWE-97

KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

High · published May 1, 2025

CVSS v4.0
8.5
EPSS
17%
Percentile
96.9
In the wild
Unconfirmed
What it is

⚡ An authenticated remote attacker only needs to craft a special filename to inject malicious scripts into your client’s browser! Think of it like ordering a pizza with instructions to sprinkle in some extra toppings, but you sneak in a few questionable ingredients that end up on the menu — if the restaurant doesn’t check the order, everyone gets served a slice of trouble! 🍕 With this cross-site scripting (XSS) vulnerability, the attacker could execute harmful scripts in users' browsers, potentially stealing sensitive information or hijacking sessions. It's a serious risk, as it could lead to major data breaches and compromise your users' trust. 😱

Put simply

Think of it like ordering a pizza with instructions to sprinkle in some extra toppings, but you sneak in a few questionable ingredients that end up on the menu — if the restaurant doesn’t check the order, everyone gets served a slice of trouble! 🍕 In KUNBUS PiCtory version 2.11.1 and earlier, a missing escape or sanitization in the handling of filenames allows an attacker to insert executable HTML script tags when these filenames are displayed to users.

What to do

With this cross-site scripting (XSS) vulnerability, the attacker could execute harmful scripts in users' browsers, potentially stealing sensitive information or hijacking sessions. It's a serious risk, as it could lead to major data breaches and compromise your users' trust. 😱 To protect against this vulnerability, upgrade to KUNBUS PiCtory version 2.11.2 or later immediately. Additionally, ensure that all inputs are properly sanitized to prevent script injection. Regularly auditing your code for similar issues can also bolster your defenses. You've got this! By taking these steps, you can protect your users and keep your application secure. 🛡️

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.17345 · 96.9th percentile
Weakness
CWE-97 · Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
Published
2025-05-01T18:42Z
EPSS history
Timeline
  • 01 MAY 18:42Z
    KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
    cvelistv5