CVE-2025-51629
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was found in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1. Attackers can inject malicious JavaScript or HTML via the Temp parameter.
Risk Assessment
The risk involves arbitrary script execution in the victim's browser, potentially leading to session theft, account takeover, or data leakage.
Recommendation
Update Agenzia Impresa Eccobook to the latest version and implement input filtering and encoding for the Temp parameter.
Other vulnerabilities in Agenzia Impresa Eccobook
See all- CVE-2025-51628High
An IDOR vulnerability in the PdfHandler component of Agenzia Impresa Eccobook version 2.81.1 and below allows unauthenticated attackers to read confidential documents by manipulating the DocumentoId parameter.
- CVE-2025-51627Medium
Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-level access to escalate privileges to Administrator.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Temp parameter.