What is the CVSS score of CVE-2025-6397?

CVE-2025-6397 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ankara Hosting Website Design Website Software are affected by CVE-2025-6397?

A reflected Cross-Site Scripting (XSS) vulnerability in Ankara Hosting Website Design software (CVSS 8.6) could allow attackers to steal user credentials, session tokens, or inject malicious content…

How to fix or mitigate CVE-2025-6397?

Within 24 hours: Inventory all instances of Ankara Hosting Website Design software and restrict user access to affected systems pending remediation. Within 7 days: Implement Web Application Firewall (WAF) rules to block malicious XSS payloads, enable input validation, and deploy Content Security Policy (CSP) headers; notify customers of the vulnerability and interim protections. Within 30 days: Apply the vendor patch immediately upon release, conduct security testing, and review server logs for exploitation attempts dating back 90 days.

Ankara Hosting Website Design Website Software CVE-2025-6397

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-03 iletisim@usom.gov.tr

XSS

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 03, 2026 - 13:15 nvd

HIGH 8.6

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ankara Hosting Website Design Website Software allows Reflected XSS.This issue affects Website Software: through 03022026.

NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Ankara Hosting Website Design Website Software. Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ankara Hosting Website Design Website Software allows Reflected XSS.This issue affects Website Software: through 03022026.

NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected ProductsAI

Product: Ankara Hosting Website Design Website Software.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.