PT-2026-3547 · Sesami · Sesamie

Miguel Jiménez · Publicado 2026-01-20 · Atualizado 2026-01-20 · CVE-2025-41084

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Sesame web application (affected versions not specified)

Description A stored Cross-Site Scripting (XSS) issue exists in the Sesame web application because uploaded SVG images are not properly sanitized. This allows attackers to embed malicious scripts in SVG files. Exploitation occurs by sending a POST request with a malicious payload using the logo parameter to the ''/api/v3/companies//logo'' API endpoint. The malicious script is then stored on the server and executed when a user accesses the compromised resource.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-41084

Produtos afetados

Sesamie

Referências · 5

• https://incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-sesame-web-application · Nota
• https://t.me/CVEtracker/42607 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-41084 · Nota de Segurança
• https://twitter.com/CVEnew/status/2013551404070154676 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2013680122017038601 · Publicação no Twitter