Is there a patch available for EUVD-2025-210975?

Yes, a patch is available for EUVD-2025-210975. Update the affected software to the latest version immediately.

UVdesk Core Framework EUVD-2025-210975

Q: What is the CVSS score of EUVD-2025-210975?

EUVD-2025-210975 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2025-71419 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-09-21 VulnCheck

GHSA-vv73-x849-w3gg

PHP XSS Community Skeleton Uvdesk Core Framework

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network stored XSS needing an authenticated agent (PR:L) and a victim to load the page (UI:R); payload executes in a different user's browser context (S:C) with limited C/I impact and no availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Metadata Corrected

Sep 21, 2026 - 14:40 vuln.today

tag: PHP added

Analysis Generated

Sep 21, 2026 - 14:38 vuln.today

DescriptionCVE.org

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.

AnalysisAI

Stored cross-site scripting in UVdesk core-framework before 1.1.7 (and community-skeleton before 1.1.8) allows an authenticated agent to inject malicious script into the SwiftMailer configuration identifier field, which is persisted and later executed in the browser of any member who views the SwiftMailer configuration update page. The vulnerability is second-order and not self-contained, requiring a privileged victim to navigate to the affected page, and patched versions reject non-alphanumeric identifiers. No public exploit code has been identified at time of analysis, and the issue is assessed as low-to-moderate priority due to the agent-level authentication and user-interaction prerequisites.

Technical ContextAI

The vulnerability resides in the SwiftMailer configuration component of UVdesk, a helpdesk system built on the Symfony PHP framework. The createMailerConfiguration action in Controller/SwiftMailer.php accepts an 'id' parameter, which is then rendered without proper output encoding in the manageConfigurations.html.twig template (line 324). This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS: the identifier is saved to the database and later inserted into the HTML context of the configuration page. The patch commit e5e92d1f5bdb24d1b96751213fb427035736371f adds server-side validation restricting the identifier to alphanumeric, underscore, and hyphen characters, and also includes a defensive check in the layout Twig template. Affected components are identified by CPE cpe:2.3:a:uvdesk:core-framework:*:*:*:*:*:*:*:* and cpe:2.3:a:uvdesk:community-skeleton:*:*:*:*:*:*:*:*; the issue affects versions before 1.1.7 and 1.1.8 respectively.

RemediationAI

Upgrade to the vendor-released patch: UVdesk core-framework 1.1.7 or later, and community-skeleton 1.1.8 or later. The fix is available via the commit e5e92d1f5bdb24d1b96751213fb427035736371f and the referenced releases. If immediate upgrade is not possible, limit the creation of mailer configurations to trusted administrators rather than agents with ROLE_AGENT, although this may reduce helpdesk flexibility; audit existing SwiftMailer configuration identifiers for suspicious characters and remove any that contain non-alphanumeric, underscore, or hyphen characters. There is no indication of active exploitation, so prioritize based on your exposure. Additional details are in the VulnCheck advisory at https://www.vulncheck.com/advisories/uvdesk-core-framework-before-1.1.7-stored-xss-via-swiftmailer.