PT-2025-25534 · Unknown · Customer Support System

Rafael Pedrero · CVE-2025-40729 · Published 2025-06-16 · Updated 2025-10-09

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Customer Support System version 1.0

Description The issue is related to a Reflected Cross-Site Scripting (XSS) in the /customer support/index.php endpoint, which allows remote attackers to execute arbitrary code via the page parameter. This enables attackers to inject malicious scripts into the webpage, potentially leading to unauthorized actions.

Recommendations For Customer Support System version 1.0, consider disabling access to the /customer support/index.php endpoint until a patch is available, or restrict the use of the page parameter to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-40729

Affected Products

Customer Support System

References · 7

• https://osv.dev/vulnerability/CVE-2025-40729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40729 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-customer-support-system · Note
• https://twitter.com/CVEnew/status/1934534118789832743 · Twitter Post
• https://twitter.com/SecAideInfo/status/1935280303930826896 · Twitter Post
• https://t.me/cvetracker/26292 · Telegram Post
• https://t.me/cveNotify/138001 · Telegram Post