CVE-2025-40647

MediumCVSS 5.1

Published: 01/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

Issabel v5.0.0 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of proper validation of user input in the 'email' parameter in '/index.php?menu=address_book'.

Risk Assessment

An attacker can store a malicious script that executes in other users' browsers, potentially leading to session theft or other attacks.

Recommendation

Update Issabel to a patched version or implement additional validation and sanitization of input in the 'email' parameter.

Other vulnerabilities in Issabel

CVE-2025-40648Medium
A Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0. It consists of a stored XSS due to a lack of proper validation of user input through the 'numero_conferencia' parameter in '/index.php?menu=conferencia'.

Original NVD description (English source)

Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'email' parameter in '/index.php?menu=address_book'.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS