Globe Document Intelligence CVE-2025-65640
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Cross Site Scripting (XSS) vulnerability in the "Task in Progress / Recent" page in Arket Globe Document Intelligence 5.0.0.559 due to improper sanitization of user input in text fields when creating a new document. Specifically, when an authenticated attacker submits data containing JavaScript code within these fields, the application fails to properly sanitize or escape the content. As a result, the injected script is executed when the page is rendered, allowing the attacker to execute arbitrary JavaScript in the context of other users' browsers who view the affected page.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in Arket Globe Document Intelligence 5.0.0.559 enables authenticated low-privilege attackers to inject persistent JavaScript payloads into document text fields, which execute in the browsers of other users viewing the 'Task in Progress / Recent' page. The CVSS High confidentiality impact (C:H) reflects the realistic risk of session token theft or account takeover against higher-privileged users such as administrators. Publicly available exploit code exists on GitHub (vincenzo-emanuele/CVE-2025-65640), and while no CISA KEV listing is present, the SSVC framework confirms exploitation-class proof-of-concept activity.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied input submitted during document creation is neither sanitized nor HTML-escaped before being rendered into the DOM on the 'Task in Progress / Recent' page, resulting in stored XSS. The attack surface is the document management workflow of Arket Globe Document Intelligence, a document intelligence platform. Because the payload persists server-side and fires on page render for any visiting user, this is a stored (persistent) XSS variant - more impactful than reflected XSS since it does not require tricking a victim into clicking a crafted link. The CPE string provided (cpe:2.3:a:n/a:n/a) is generic and not product-specific, so affected version identification relies exclusively on the CVE description citing version 5.0.0.559.
RemediationAI
No vendor-released patch has been identified at time of analysis. Organizations should monitor the Arket vendor site (https://www.arket.it/) for a patched release addressing this stored XSS. As compensating controls: implement a strict Content Security Policy (CSP) header with 'script-src self' to block inline script execution - note this may break legitimate functionality and requires application testing before deployment. Deploy WAF rules targeting XSS payloads (script tags, JavaScript event handler attributes) on document creation endpoints; this reduces risk but may cause false positives on legitimate rich-text content. Restrict document creation privileges to the minimum necessary set of users, reducing the pool of potential attackers. The public PoC at https://github.com/vincenzo-emanuele/CVE-2025-65640 can be used to validate whether compensating controls are effective before a vendor patch is available.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today