PT-2025-44401 · Unknown · Urve Smart Office

Anna Błaszczak + 1 · Publicado 2025-10-30 · Atualizado 2025-10-30 · CVE-2025-10348

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions URVE Smart Office versions prior to 1.1.24

Description URVE Smart Office is susceptible to a Stored Cross-Site Scripting (XSS) issue within the report problem functionality. An attacker possessing a low-privileged account can upload a Scalable Vector Graphics (SVG) file containing a malicious payload. Upon a victim accessing the URL of the uploaded resource, the malicious payload is executed. The resource is accessible to anyone without requiring authentication.

Recommendations Upgrade to version 1.1.24 or later to address this issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-10348

Produtos afetados

Urve Smart Office

Referências · 5

• https://t.me/CVEtracker/36181 · Publicação no Telegram
• https://t.me/cveNotify/140940 · Publicação no Telegram
• https://smartoffice.expert · Nota
• https://cert.pl/posts/2025/10/CVE-2025-10348 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-10348 · Nota de Segurança