ixmaps website2017 CVE-2025-11291

Q: What is the CVSS score of CVE-2025-11291?

CVE-2025-11291 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-10-05 cna@vuldb.com

PHP XSS

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:51 vuln.today

DescriptionCVE.org

A security flaw has been discovered in ixmaps website2017 up to 0c71cffa0162186bc057a76766bc97e9f5a3a2d0. This impacts an unknown function of the file /map.php of the component HTTP GET Request Handler. Performing manipulation of the argument trid results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Cross-site scripting (XSS) in ixmaps website2017 via unsanitized trid parameter in /map.php HTTP GET requests allows remote attackers to inject arbitrary JavaScript that executes in users' browsers with user interaction. The vulnerability affects an unknown version up to commit 0c71cffa0162186bc057a76766bc97e9f5a3a2d0, exploit code has been publicly released, and the vendor has not responded to disclosure notifications. CVSS 2.1 (Low) reflects minimal confidentiality impact and required user interaction, though EPSS 0.03% indicates low real-world exploitation probability.

Technical ContextAI

The vulnerability is a Stored or Reflected XSS (CWE-79) in a PHP web application. The /map.php endpoint processes HTTP GET request parameters, specifically the 'trid' argument, without proper input validation or output encoding. The GET request handler fails to sanitize user-supplied input before reflecting it in the HTTP response or storing it in application state, allowing an attacker to inject malicious JavaScript code. Because ixmaps website2017 uses continuous delivery with rolling releases (no versioned releases), the affected codebase is identified only by Git commit hash (0c71cffa0162186bc057a76766bc97e9f5a3a2d0), making traditional version-based patch tracking impossible.

Affected ProductsAI

ixmaps website2017 up to and including Git commit 0c71cffa0162186bc057a76766bc97e9f5a3a2d0. Because the product uses continuous delivery with rolling releases rather than version-based releases, specific version numbers are not available. The affected codebase is a web application written in PHP, identified by the GitHub repository and commit history referenced in VulDB and GitHub Issues.

RemediationAI

No vendor-released patch has been issued due to lack of vendor response. For deployments of ixmaps website2017, apply the most current version from the project's main branch (post-commit 0c71cffa0162186bc057a76766bc97e9f5a3a2d0) if available, as the rolling-release model suggests fixes may be deployed incrementally without formal versioning. Manual mitigation requires code review and patching of /map.php to implement input validation and output encoding: (1) validate the 'trid' parameter against a whitelist of expected values or format (e.g., alphanumeric only, maximum length), (2) use context-appropriate output encoding (HTML entity encoding for HTML context, JavaScript encoding for script context) when reflecting trid in responses, and (3) implement a Content Security Policy (CSP) header to block inline script execution and restrict script sources. If the application cannot be immediately patched, restrict network access to /map.php via Web Application Firewall (WAF) rules that block GET requests containing suspicious patterns in the trid parameter (e.g., script tags, event handlers). These controls mitigate the attack but do not eliminate the underlying vulnerability and may block legitimate requests if tuned too aggressively.