CVE-2025-14691

MediumCVSS 4.3

Published: 14/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

38th percentile - higher than 38% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability has been detected in Mayan EDMS up to version 4.10.1, affecting an unknown function in the /authentication/ file. The attack can be performed remotely. The exploit is now public. Upgrading to version 4.10.2 fixes the issue.

Risk Assessment

An attacker can inject malicious scripts into users' browsers, potentially leading to session theft, account takeover, or malware distribution.

Recommendation

Upgrade Mayan EDMS to version 4.10.2 or later as soon as possible. Implementing input filters and Content Security Policy (CSP) can reduce the risk.

Other vulnerabilities in Mayan EDMS

CVE-2025-14692Medium
An open redirect vulnerability has been found in Mayan EDMS up to version 4.10.1, affecting an unknown function in the /authentication/ file. The attack can be performed remotely. The exploit is publicly available. Upgrading to version 4.10.2 resolves the issue.

Original NVD description (English source)

A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.10.2 is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms that this is "[f]ixed in version 4.10.2". Furthermore, that "[b]ackports for older versions in process and will be out as soon as their respective CI pipelines complete."

Vulnerability data from NVD (NIST) · CISA KEV · EPSS