CVE-2025-59903CWE-79

Stored Cross-Site Scripting (XSS) in Kubysoft

Medium · published February 16, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

Stored Cross-Site Scripting (XSS) vulnerability in Kubysoft, where uploaded SVG images are not properly sanitized. This allows attackers to embed malicious scripts within SVG files as visual content, which are then stored on the server and executed in the context of any user accessing the compromised resource.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N
EPSS
0.00158 · 4.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-16T09:55Z
EPSS history
Timeline
  • 16 FEB 09:55Z
    Stored Cross-Site Scripting (XSS) in Kubysoft
    cvelistv5