What is the CVSS score of CVE-2025-10914?

CVE-2025-10914 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Proliz OBS are affected by CVE-2025-10914?

Proliz Software OBS (Student Affairs Information System) contains a reflected cross-site scripting vulnerability (CVE-2025-10914) in versions prior to V26.0401 that could allow attackers to steal…

How to fix or mitigate CVE-2025-10914?

24 hours: Inventory all OBS installations; identify affected versions (pre-V26.0401); assess number of exposed users and data classification of accessible records. 7 days: Deploy content security policy headers and web application firewall rules to block XSS patterns; issue user advisory warning against clicking untrusted links; enable session monitoring. 30 days: Obtain and deploy OBS V26.0401 or newer from Proliz Software; conduct post-deployment validation; review access logs for signs of exploitation.

Proliz OBS CVE-2025-10914

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-10-23 iletisim@usom.gov.tr

XSS

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 08:30 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. Co. OBS (Student Affairs Information System) allows Reflected XSS.

This issue affects OBS (Student Affairs Information System): before V26.0401.

AnalysisAI

Reflected cross-site scripting in Proliz Software OBS (Student Affairs Information System) prior to V26.0401 allows remote attackers to execute arbitrary JavaScript in a victim's browser session after luring them to click a crafted link. The high CVSS of 7.6 reflects unauthenticated network exploitation with high confidentiality impact, though no public exploit identified at time of analysis and EPSS data was not provided. The flaw was reported by Turkey's national CERT (USOM), indicating regional relevance for Turkish higher-education institutions that use this Student Affairs platform.

Technical ContextAI

OBS (Öğrenci Bilgi Sistemi) is a Turkish-language Student Affairs Information System developed by Proliz Software Ltd. Co. and widely deployed at Turkish universities to manage enrollment, grades, transcripts, and student records. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): user-controlled input is reflected back into an HTTP response without proper output encoding or contextual escaping, so attacker-supplied script payloads execute in the trusted origin of the OBS web application. Because the vulnerability is reflected rather than stored, the malicious payload travels in the request (typically a URL parameter) and is echoed into the rendered page.

Affected ProductsAI

Proliz Software Ltd. Co. OBS (Student Affairs Information System / Öğrenci Bilgi Sistemi) at all versions before V26.0401 is affected. No CPE string was published in the available data. Vendor and national-CERT advisories are available at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0357 and https://www.usom.gov.tr/bildirim/tr-25-0357.

RemediationAI

Upgrade Proliz OBS to V26.0401 or later, which is the vendor-released fixed version referenced in the USOM advisory (https://www.usom.gov.tr/bildirim/tr-25-0357 and https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0357). Until patching is possible, deploy a WAF rule or reverse-proxy filter that blocks request parameters containing common XSS payload patterns (script tags, javascript: URIs, on* event handlers) destined for OBS endpoints - with the trade-off of potential false positives on legitimate rich input. Additionally, enforce a strict Content-Security-Policy header that disallows inline script and restricts script-src to known origins, accepting that this may break legacy OBS UI features and require regression testing, and instruct staff and students to avoid clicking OBS links arriving via email or chat from untrusted sources.