CVE-2025-61074CWE-79cross-site-scripting

CVE-2025-61074

Medium · published December 9, 2025

CVSS v3.1
4.6
EPSS
0%
Percentile
26.4
In the wild
Unconfirmed
What it is

A stored Cross Site Scripting (XSS) vulnerability in the bulletin board (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 allows remote authenticated users to execute arbitrary JavaScript code in the web browser of other users via manipulation of the 'Inhalt' parameter of the '/SchwarzeBrett/Nachrichten/CreateNachricht' or '/SchwarzeBrett/Nachrichten/EditNachricht/' requests.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00342 · 26.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-09T21:17Z
Affected products (1)
ProductVersionsFixed in
adata/mitarbeiter_portal< 2.16.12.16.1
References (2)
https://no-sec.net/posts/cve-2025-61074/ · [email protected]https://www.adata.de/mitarbeiter-portal/ · [email protected]
EPSS history
Timeline
  • 09 DEC 00:00Z
    A stored Cross Site Scripting (XSS) vulnerability in the bulletin board (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 allows remote…
    cvelistv5