PT-2025-16255 · Unknown · Sicommnet Basec

Frank Breedijk + 1 · Published 2025-04-14 · Updated 2025-04-15 · CVE-2025-22373

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/V:C

Name of the Vulnerable Software and Affected Versions: SicommNet BASEC versions from 14 Dec 2021

Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Reflected XSS, XSS Through HTTP Query Strings, Rendering of Arbitrary HTML, and alteration of CSS Styles.

Recommendations: For versions from 14 Dec 2021, as a temporary workaround, consider restricting user input in web page generation to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-22373

Affected Products

Sicommnet Basec

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-22373 · Security Note
• https://csirt.divd.nl/CVE-2025-22373 · Note
• https://twitter.com/CveFindCom/status/1911811964893901161 · Twitter Post
• https://t.me/cvedetector/22865 · Telegram Post
• https://twitter.com/CVEnew/status/1911809396201635966 · Twitter Post
• https://cisrt.divd.nl/CVE-2025-22373 · Note
• https://twitter.com/impulsewebdesig/status/1912097943894507532 · Twitter Post
• https://basec.sicomm.net/login · Note
• https://twitter.com/VulmonFeeds/status/1911847891036971170 · Twitter Post
• https://t.me/cvetracker/21553 · Telegram Post
• https://csirt.divd.nl/DIVD-2025-00001 · Note