What is the CVSS score of CVE-2025-8668?

CVE-2025-8668 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of E-Kalite Software Hardware Engineering Design are affected by CVE-2025-8668?

A critical cross-site scripting vulnerability (CVE-2025-8668, CVSS 9.4) affects E-Kalite Software systems with no patch currently available, exposing the organization to potential account compromise,…

How to fix or mitigate CVE-2025-8668?

Within 24 hours: Inventory all E-Kalite Software instances in production and development environments; disable public-facing access to affected systems if operationally feasible; brief incident response team. Within 7 days: Implement Web Application Firewall (WAF) rules to block malicious script injection patterns; enable comprehensive logging and monitoring on affected applications; conduct user awareness training on phishing and social engineering. Within 30 days: Establish vendor communication channel for patch availability; develop testing plan for patch deployment; consider alternative solutions or system isolation if patches remain unavailable beyond 30 days.

E-Kalite Software Hardware Engineering Design CVE-2025-8668

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-02-11 iletisim@usom.gov.tr

XSS

9.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 14:16 nvd

CRITICAL 9.4

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard allows Reflected XSS.This issue affects Turboard: from 2025.07 before 2026.02. NOTE: This CVE record updated after the vendor implemented mitigations.