CVE-2025-8456CWE-79

Reflected XSS in Kod8 Software's Kod8 Individual and SME Website

High · published February 3, 2026

CVSS v3.1
7.6
EPSS
0%
Percentile
10.1
In the wild
Unconfirmed
What it is

⚡ A sneaky little XSS vulnerability is hiding in the Kod8 Individual and SME Website! This means attackers can reflect malicious scripts right back at users. 🔥 Think of it like a restaurant that serves a customer's order without checking if there's a hidden allergen in the dish — one clever tweak and it could be a recipe for disaster! If exploited, an attacker could inject harmful scripts that run in the user's browser. This could lead to stolen credentials, hijacked sessions, or even malicious redirects, turning a simple website visit into a chaotic mess for unsuspecting users!

Put simply

Think of it like a restaurant that serves a customer's order without checking if there's a hidden allergen in the dish — one clever tweak and it could be a recipe for disaster! This reflected XSS vulnerability occurs due to improper neutralization of user input during web page generation, allowing attackers to manipulate the webpage and execute arbitrary scripts in a victim's browser.

What to do

If exploited, an attacker could inject harmful scripts that run in the user's browser. This could lead to stolen credentials, hijacked sessions, or even malicious redirects, turning a simple website visit into a chaotic mess for unsuspecting users! Immediate action is needed! Update to the latest version of Kod8 to patch this vulnerability. Additionally, implement input validation and output encoding to prevent similar issues from cropping up in the future. You've got this! Fixing this is totally within your reach — let’s secure that website! 🛡️

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00206 · 10.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-03T08:22Z
EPSS history
Timeline
  • 03 FEB 08:22Z
    Reflected XSS in Kod8 Software's Kod8 Individual and SME Website
    cvelistv5