PT-2026-5693 · Luna · Luna

CVE-2025-41065 · Publicado 2026-02-02 · Atualizado 2026-02-03

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions LUNA software version 7.5.5.6

Description A stored Cross-Site Scripting (XSS) issue exists in LUNA software. This allows an attacker to execute JavaScript code in a victim’s browser by injecting a malicious payload through the 'Edit Batch Name' function. The payload is stored by the application and displayed without proper sanitization when accessed by other users. This can lead to the theft of sensitive user data, such as session cookies, or actions performed on behalf of the user. The vulnerable function is Edit Batch Name.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the 'Edit Batch Name' function until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-41065

Produtos afetados

Luna

Referências · 6

• https://incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-luna-luna-imaging · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-41065 · Nota de Segurança
• https://t.me/cveNotify/150707 · Publicação no Telegram
• https://t.me/CVEtracker/43590 · Publicação no Telegram
• https://twitter.com/incibe_cert/status/2018313172722065538 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2018683937363575112 · Publicação no Twitter