CVE-2025-41087CWE-79cross-site-scripting

CVE-2025-41087

published November 24, 2025

CVSS
5.1
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

Cross-Site Scripting (XSS) vulnerability stored in tha Taclia web application, where the uploaded SVG images are not properly sanitized. This allows to the attackers to embed malicious scripts in SVG files such as image profiles, which are then stored on the server and executed in the context of any user who accesses the compromised resource.

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00286 · 20.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-11-24T17:15Z
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-stored-taclias-web-application · [email protected]
EPSS history
Timeline
  • 24 NOV 11:27Z
    Cross-Site Scripting (XSS) stored in Taclia's web application
    cvelistv5