PT-2026-7509 · Microcom · Zeusweb

Publicado 2026-02-11 · Atualizado 2026-02-11 · CVE-2025-13650

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZeusWeb version 6.1.31

Description An attacker with access to the ZeusWeb web application can inject arbitrary JavaScript code. This is achieved by injecting an XSS payload into the Surname parameter of the ‘Create Account’ operation. The vulnerable URL is ''https://zeus.microcom.es:4040/index.html?zeus6=true''. No registration is required to perform this action.

Recommendations Apply a fix to the Surname parameter input validation in the ‘Create Account’ operation to prevent the injection of JavaScript code.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-13650

Produtos afetados

Zeusweb

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13650 · Nota de Segurança
• https://zeus.microcom.es:4040 · Nota
• https://microcom360.com/servicio-zeus-web · Nota
• https://t.me/cveNotify/151672 · Publicação no Telegram
• https://hackrtu.com/blog/CNA-HRTU-0001 · Correção
• https://t.me/CVEtracker/44386 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2021554587065331733 · Publicação no Twitter
• https://hackrtu.com/blog/CNA-CVE-2025-13650 · Correção