What is the CVSS score of EUVD-2025-209607?

EUVD-2025-209607 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

GSVoIP Web Panel EUVD-2025-209607

| CVE-2025-69606 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-01 cve@mitre.org

PHP XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 20:31 vuln.today

CVSS changed

May 01, 2026 - 19:22 NVD

6.1 (None) 6.1 (MEDIUM)

EUVD ID Assigned

May 01, 2026 - 18:22 euvd

EUVD-2025-209607

Analysis Generated

May 01, 2026 - 18:22 vuln.today

CVE Published

May 01, 2026 - 18:16 nvd

MEDIUM 6.1

DescriptionCVE.org

Cross-Site Scripting (XSS) vulnerability was discovered in the GSVoIP web panel version 2.0.90. The msg parameter in the /painel/gateways.php/error endpoint does not properly sanitize user-supplied input, allowing attackers to inject arbitrary JavaScript into the HTML response. A remote attacker can exploit this vulnerability by sending a crafted URL to a victim, leading to unauthorized script execution, session hijacking, phishing, or other client-side attacks.

AnalysisAI

Reflected cross-site scripting (XSS) in GSVoIP web panel version 2.0.90 allows remote attackers to inject arbitrary JavaScript via the msg parameter in the /painel/gateways.php/error endpoint. The vulnerability requires user interaction (clicking a malicious link) but can lead to session hijacking, credential theft, or malware distribution. No authentication is required, and public exploit code exists.

Technical ContextAI

GSVoIP is a PHP-based VoIP administration panel. The vulnerability exists in the error handling endpoint /painel/gateways.php/error, which reflects user-supplied input from the msg parameter directly into the HTML response without sanitization or encoding. This is a classic reflected XSS vulnerability (CWE-79) where an attacker can inject HTML and JavaScript tags into the response, which are then executed by the victim's browser in the context of the VoIP panel domain. The lack of Content Security Policy (CSP) headers and output encoding allows arbitrary scripts to run with the same privileges as the authenticated user viewing the page.

RemediationAI

Upgrade GSVoIP web panel to a patched version released after version 2.0.90. Implement immediate input validation and output encoding: sanitize the msg parameter using a whitelist of safe characters or HTML entity encoding before reflecting it in responses. Apply context-aware output encoding (HTML encoding for HTML context, JavaScript encoding for JavaScript context). Implement Content Security Policy (CSP) headers with script-src 'self' to prevent inline script execution. For temporary mitigation pending patching, restrict access to the /painel/gateways.php/error endpoint to trusted IP ranges (e.g., internal networks only) via web server configuration (.htaccess or nginx rules). Disable or remove the error endpoint if it is not actively used. Note: restricting access reduces immediate risk but does not eliminate the vulnerability if internal users are targeted via phishing.