CVE-2025-62857CWE-79cross-site-scripting

CVE-2025-62857

Medium · published January 2, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
12.2
In the wild
Unconfirmed
What it is

A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following version:

QuMagie 2.8.1 and later

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00223 · 12.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-02T20:16Z
Affected products (1)
ProductVersionsFixed in
qnap/qumagie≥ 2.0.0, < 2.8.12.8.1
References (1)
https://www.qnap.com/en/security-advisory/qsa-25-49 · [email protected]
EPSS history
Timeline
  • 02 JAN 14:51Z
    QuMagie
    cvelistv5