Which versions of PHP are affected by EUVD-2025-209049?

CVE-2025-41027 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 5.1. Attackers could inject scripts to steal sessions or perform actions as authenticated users.. A patch is available.

How to fix or mitigate EUVD-2025-209049?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP EUVD-2025-209049

Q: What is the CVSS score of EUVD-2025-209049?

EUVD-2025-209049 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2025-41027 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-26 INCIBE

XSS PHP

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 13:15 euvd

EUVD-2025-209049

Analysis Generated

Mar 26, 2026 - 13:15 vuln.today

Patch released

Mar 26, 2026 - 13:15 nvd

Patch available

CVE Published

Mar 26, 2026 - 12:42 nvd

MEDIUM 5.1

DescriptionCVE.org

Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller. These vulnerabilities allows an attacker execute JavaScript code in the victim's browser by sending a malicious URL in 'site' parameter in 'app_recuperarclave.php'.

AnalysisAI

GDTaller allows unauthenticated remote attackers to execute arbitrary JavaScript in victim browsers through reflected cross-site scripting (XSS) via the 'site' parameter in app_recuperarclave.php. The vulnerability affects all versions of GDTaller (version 0 and beyond) and has been assigned a CVSS 4.0 base score of 5.1 with limited scope impact. A vendor patch is available from INCIBE, and exploitation requires user interaction (UI:A) but presents moderate risk due to the network-accessible attack surface and low technical complexity.

Technical ContextAI

GDTaller is a PHP-based application (identified via CPE cpe:2.3:a:gdtaller:gdtaller) vulnerable to CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting). The vulnerability exists in the password recovery endpoint (app_recuperarclave.php), which fails to properly sanitize the 'site' parameter before reflecting it in HTTP responses. This is a classic reflected XSS flaw where user-supplied input is directly incorporated into the HTML/JavaScript context without encoding or validation, allowing attackers to inject malicious script payloads that execute in the security context of the victim's browser session.

RemediationAI

Upgrade GDTaller to the patched version released by the vendor as documented in the INCIBE security notice (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gdtaller). Until patching is completed, implement input validation and output encoding on the 'site' parameter in app_recuperarclave.php to neutralize script injection attempts; specifically, ensure all user input is HTML-encoded before reflection in HTTP responses and consider implementing Content-Security-Policy (CSP) headers to restrict inline script execution. Additionally, restrict access to the password-recovery endpoint via network controls if feasible, and educate users not to click links in unsolicited emails or messages directing them to this endpoint with suspicious query parameters.