PT-2026-1656 · Data Illusion · Zumbrunn Ngsurvey Enterprise Edition

Thomas Clair · Publicado 2026-01-07 · Atualizado 2026-01-29 · CVE-2025-15479

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Data Illusion Zumbrunn NGSurvey Enterprise Edition version 3.6.4

Description The software contains a stored cross-site scripting issue. This affects the survey content and administration functionality, allowing authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users’ browsers. This could lead to session information theft and unauthorized actions. The issue occurs because crafted survey content is rendered without proper output encoding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-15479

Produtos afetados

Zumbrunn Ngsurvey Enterprise Edition

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-15479 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-15479 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2008900742787076564 · Publicação no Twitter
• https://t.me/CVEtracker/41608 · Publicação no Telegram
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2025-15479 · Nota
• https://docs.ngsurvey.com/installation-setup/change-log#id-3.6.17-2025-05-28 · Aviso do Fabricante
• https://t.me/cveNotify/150228 · Publicação no Telegram