CVE-2025-36558CWE-97

KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

Medium · published May 1, 2025

CVSS v4.0

5.1

EPSS

19%

Percentile

97.1

In the wild

Unconfirmed

What it is

KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the sso_token used for authentication. If an attacker provides the user with a PiCtory URL containing an HTML script as an sso_token, that script will reply to the user and be executed.

The record

Technical detail

CVSS v4.0: 5.1 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS: 0.18851 · 97.1th percentile
Weakness: CWE-97 · Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
Published: 2025-05-01T18:44Z

EPSS history

Timeline

01 MAY 18:44Z
KUNBUS Revolution Pi Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
cvelistv5