Proliz OBS CVE-2025-10914

Exploitation requires (per the CVSS vector UI:R) that a victim with an active OBS session click an attacker-crafted URL pointing at a vulnerable reflected parameter in the OBS web interface; no attacker authentication is needed (PR:N) and the OBS instance must be network-reachable to the attacker (AV:N), which in practice means an internet-exposed university OBS portal. The CVE description does not name the specific vulnerable parameter or endpoint, so the exact reflected sink is not enumerated in available data. Realistic risk is limited to organizations running Proliz OBS - predominantly Turkish higher-education institutions - and is constrained by the need for social engineering to deliver the link to an authenticated user.

The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L indicates an unauthenticated, low-complexity, network-reachable attack that does require user interaction (clicking a crafted link). The unusually high confidentiality impact (C:H) for a reflected XSS suggests that successful exploitation likely yields session tokens or sensitive student data accessible to an authenticated victim - consistent with a SaaS-like student records portal. There is no KEV listing, no public POC referenced, and no EPSS score in the provided data, so the signal is mixed: CVSS rates this High but no exploitation telemetry is available. The fact that Turkey's CERT (USOM) publicly disclosed the issue suggests a credible, vendor-acknowledged finding worth prioritizing for Turkish university IT teams, but generic global urgency is lower than the 7.6 score implies in isolation.

An attacker crafts a URL targeting a vulnerable OBS endpoint with a malicious script payload in a reflected parameter and sends it to a logged-in student, faculty member, or administrator via phishing email or chat. When the victim clicks the link, their browser executes the attacker's script under the OBS origin, exfiltrating session cookies, scraping displayed grades or personal data, or performing actions as the victim within the student information system.