PT-2025-14784 · Dowisp · Dowisp

Published 2025-04-03 · Updated 2025-04-05 · CVE-2025-3189

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions DoWISP versions prior to 1.16.2.50

Description The issue is related to a Stored Cross-Site Scripting (XSS) in DoWISP, where an attacker can upload a profile picture in SVG format containing malicious JavaScript code, leading to the execution of this code when the picture is viewed.

Recommendations For versions prior to 1.16.2.50, update to version 1.16.2.50 or later to resolve the issue. As a temporary workaround, consider restricting the upload of SVG files or disabling the profile picture upload feature until a patch is applied.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-3189

Affected Products

Dowisp

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-3189 · Security Note
• https://twitter.com/CVEnew/status/1908438489919611044 · Twitter Post
• https://twitter.com/incibe_cert/status/1907765400420393029 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-dowisp · Note
• https://t.me/cvenotify/117751 · Telegram Post
• https://t.me/cvetracker/20824 · Telegram Post
• https://t.me/cvedetector/22123 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1908148409493500224 · Twitter Post