What is the CVSS score of CVE-2025-63499?

CVE-2025-63499 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Ubuntu are affected by CVE-2025-63499?

Organizations using Alinto Sogo 5.12.3 should be aware of moderate risk from CVE-2025-63499, a cross-site scripting vulnerability rated CVSS 6.1.. A patch is available.

Is there a public PoC exploit available for CVE-2025-63499?

Yes, a public proof-of-concept exploit is available for CVE-2025-63499. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-63499?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Ubuntu CVE-2025-63499

EUVD-2025-201283 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-04 cve@mitre.org

XSS Ubuntu Debian Sogo

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201283

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

PoC Detected

Dec 18, 2025 - 20:24 vuln.today

Public exploit code

CVE Published

Dec 04, 2025 - 20:16 nvd

MEDIUM 6.1

DescriptionCVE.org

Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.

Analysis

Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.

More in Sogo

View all

CVE-2015-5395 HIGH This Week POC

8.8 Sep 20

Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0. Rated high severity (CVSS 8.8), this vulnerability

CVE-2025-63498 MEDIUM This Month POC

6.1 Nov 24

alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter. Rated medium severity (CVSS

CVE-2016-6189 MEDIUM This Month POC

4.3 Feb 17

Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive in

CVE-2021-33054 HIGH This Week

7.5 Jun 04

SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receiv

CVE-2026-46446 HIGH This Week

7.1 May 14

SQL injection in SOGo versions prior to 5.12.7 allows authenticated users to inject arbitrary SQL when changing their pa

CVE-2026-46445 HIGH This Week

7.1 May 14

SQL injection in Alinto SOGo versions prior to 5.12.7 allows authenticated remote attackers to manipulate database queri

CVE-2016-6188 MEDIUM This Month

6.5 Feb 03

Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number o

CVE-2025-71276 MEDIUM This Month

6.4 Mar 22

SOGo before version 5.12.5 contains a cross-site scripting (XSS) vulnerability affecting the events, tasks, and contacts

CVE-2014-9905 MEDIUM This Month

6.1 Feb 17

Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to i

CVE-2016-6191 MEDIUM This Month

6.1 Feb 17

Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3

CVE-2026-8496 MEDIUM This Month

6.1 May 13

Stored XSS in Alinto SOGo's ICS calendar invitation viewer enables a remote unauthenticated attacker to execute arbitrar

CVE-2024-24510 MEDIUM This Month

6.1 Sep 09

Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via t

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2016-8581 MEDIUM POC

6.1

CVE-2013-5223 MEDIUM POC

5.4

CVE-2025-52367 MEDIUM POC

5.4

CVE-2015-0072 MEDIUM POC

4.3

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

9.8

CVE-2013-1710 CRITICAL POC

10.0

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2024-52875 HIGH POC

8.8

CVE-2016-8581 MEDIUM POC

6.1

Vendor StatusVendor

Ubuntu

Priority: Medium

sogo

Release	Status	Version
xenial	needs-triage	-
bionic	needs-triage	-
focal	needs-triage	-
jammy	needs-triage	-
noble	DNE	-
questing	needs-triage	-
upstream	needs-triage	-
plucky	ignored	end of life, was needs-triage

Debian

Bug #1121952

sogo

Release	Status	Fixed Version	Urgency
bullseye	fixed	5.0.1-4+deb11u3	-
bullseye (security)	fixed	5.0.1-4+deb11u3	-
bookworm	fixed	5.8.0-2+deb12u1	-
trixie	fixed	5.12.1-3+deb13u1	-
forky, sid	fixed	5.12.4-1.2	-
(unstable)	fixed	5.12.4-1.2	-

DLA-4434-1

CVE-2025-63499 vulnerability details – vuln.today

Back

Ubuntu CVE-2025-63499

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Sogo

Same weakness CWE-79 – Cross-site Scripting (XSS)

Same technique XSS

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code