CVE-2025-40633CWE-79

Stored Cross-Site Scripting (XSS) in Koibox

Medium · published May 20, 2025

CVSS v4.0
5.1
EPSS
0%
Percentile
30.4
In the wild
Unconfirmed
What it is

A Stored Cross-Site Scripting (XSS) vulnerability has been found in

Koibox for versions prior to e8cbce2. This vulnerability allows an

authenticated attacker to upload an image containing malicious

JavaScript code as profile picture in the

'/es/dashboard/clientes/ficha/' endpoint

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00376 · 30.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-05-20T10:17Z
EPSS history
Timeline
  • 20 MAY 10:17Z
    Stored Cross-Site Scripting (XSS) in Koibox
    cvelistv5