CVE-2025-9158CWE-79cross-site-scripting

CVE-2025-9158

published October 24, 2025

CVSS
5.3
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user.

This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00447 · 37.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-24T10:15Z
References (2)
https://cert.pl/en/posts/2025/10/CVE-2025-9158/ · [email protected]https://requesttracker.com/request-tracker/ · [email protected]
EPSS history
Timeline
  • 24 OCT 06:00Z
    Stored XSS in Request Tracker
    cvelistv5