EUVD-2025-201283CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionNVD
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
Analysis
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
Technical ContextAI
Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.
RemediationAI
Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.
More from same product – last 7 days
Authentication-context bypass in pam_usb before 0.9.0 lets a person holding an enrolled USB device authenticate over SSH
pam_usb prior to 0.9.0 crashes under memory pressure due to assert()-based OOM guards in src/mem.c that are silently str
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removin
In the Linux kernel, the following vulnerability has been resolved: ksmbd: call ksmbd_vfs_kern_path_end_removing() on s
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix invalid deref of rawdata when export_
Vendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | DNE | - |
| questing | needs-triage | - |
| upstream | needs-triage | - |
| plucky | ignored | end of life, was needs-triage |
Debian
Bug #1121952| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 5.0.1-4+deb11u3 | - |
| bullseye (security) | fixed | 5.0.1-4+deb11u3 | - |
| bookworm | fixed | 5.8.0-2+deb12u1 | - |
| trixie | fixed | 5.12.1-3+deb13u1 | - |
| forky, sid | fixed | 5.12.4-1.2 | - |
| (unstable) | fixed | 5.12.4-1.2 | - |
Share
External POC / Exploit Code
Leaving vuln.today