PT-2025-21236 · Pichome · Pichome

Published 2025-05-14 · Updated 2025-05-14 · CVE-2025-44024

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Pichome system versions prior to 2.1.0

Description: A Cross-Site Scripting (XSS) issue was found due to insufficient sanitization of user input in the login form. This allows an attacker to inject malicious JavaScript code into the username or password fields during the login process.

Recommendations: For versions prior to 2.1.0, update to a version that includes proper sanitization of user input in the login form to prevent XSS attacks. As a temporary workaround, consider validating and sanitizing user input for the username and password fields to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-44024

Affected Products

Pichome

References · 5

• 🔥 https://github.com/zyx0814/Pichome/issues/50 · Exploit
• https://osv.dev/vulnerability/CVE-2025-44024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-44024 · Security Note
• https://t.me/cvetracker/23865 · Telegram Post
• https://twitter.com/CVEnew/status/1922765626457854057 · Twitter Post