Gdtaller EUVD-2025-209049

The CVSS 4.0 vector indicates a low-to-moderate severity profile: Attack Vector is Network (AV:N) and Complexity is Low (AC:L), indicating broad accessibility without special prerequisites, but Privileges Required is None (PR:N) and User Interaction is required (UI:A), meaning victims must click a malicious link. The SSVC framework assessment-Exploitation: none, Automatable: no, Technical Impact: partial-signals that while no active exploitation has been confirmed, the vulnerability is not yet weaponized at scale. The low 5.1 CVSS score and SSVC 'partial' technical impact suggest the real-world priority is moderate rather than critical; this is not a network-worm or widespread-compromise scenario. The absence of confirmed KEV status and lack of public exploit code further support controlled real-world risk, though any XSS in a password-recovery flow warrants timely patching due to potential session hijacking or credential theft via phishing amplification.

An attacker crafts a malicious URL containing JavaScript payload in the 'site' parameter (e.g., 'app_recuperarclave.php?site=<script>...</script>') and sends it to a victim via phishing email or social engineering. When the victim clicks the link, the payload is reflected in the response and executed in their browser, potentially allowing the attacker to steal session cookies, redirect to a credential-harvesting page mimicking the legitimate password-reset form, or perform actions on behalf of the victim within the GDTaller application. User interaction (clicking the link) is required, and no public exploit code or CISA KEV confirmation indicates active exploitation, but the attack surface is entirely remote and unauthenticated.