CVE-2025-40648

MediumCVSS 4.8

Published: 01/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

A Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0. It consists of a stored XSS due to a lack of proper validation of user input through the 'numero_conferencia' parameter in '/index.php?menu=conferencia'.

Risk Assessment

An attacker can store a malicious script that executes in other users’ browsers. This may lead to session hijacking, credential theft, or unauthorized actions.

Recommendation

Update Issabel to a version containing the fix. Implement validation and escaping of input in the 'numero_conferencia' parameter.

Other vulnerabilities in Issabel

CVE-2025-40647Medium
Issabel v5.0.0 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of proper validation of user input in the 'email' parameter in '/index.php?menu=address_book'.

Original NVD description (English source)

Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'numero_conferencia' parameter in '/index.php?menu=conferencia'.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS