PT-2025-22921 · Realce Tecnologia · Realce Tecnologia Queue Ticket Kiosk

J369 · Published 2025-05-26 · Updated 2025-05-26 · CVE-2025-5179

Positive Technologies (AI Summary)

CVSS v3.1

3.4

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Realce Tecnologia Queue Ticket Kiosk up to 20250517

Description A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk, affecting an unknown functionality of the file /adm/index.php of the component Cadastro de Administrador Page. The manipulation of the Name/Usuário argument leads to cross-site scripting. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations For Realce Tecnologia Queue Ticket Kiosk up to 20250517, as a temporary workaround, consider restricting access to the /adm/index.php file and the Name/Usuário argument to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-5179

Affected Products

Realce Tecnologia Queue Ticket Kiosk

References · 7

• https://osv.dev/vulnerability/CVE-2025-5179 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5179 · Security Note
• https://vuldb.com/?id.310267 · Note
• https://twitter.com/CVEnew/status/1926940542128066576 · Twitter Post
• https://t.me/cvetracker/24638 · Telegram Post
• https://vuldb.com/?submit.579852 · Note
• https://vuldb.com/?ctiid.310267 · Note