PT-2025-40824 · Vanderlande · Vanderlande Baggage 360

Yasserreed · Published 2025-10-05 · Updated 2025-10-06 · CVE-2025-11308

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Vanderlande Baggage 360 version 7.0.0

Description An issue exists in the processing of files within Vanderlande Baggage 360. Manipulation of the Message argument in the /api-addons/v1/messages API endpoint can lead to cross site scripting. This attack can be performed remotely. The exploit is publicly available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-11308

Affected Products

Vanderlande Baggage 360

References · 9

• 🔥 https://github.com/YasserREED/YasserREED-CVEs/blob/main/Vanderlande-OpenAIR-Baggage360/Stored%20Cross-Site%20Scripting%20(XSS).md · Exploit
• 🔥 https://github.com/YasserREED/YasserREED-CVEs/blob/main/Vanderlande-OpenAIR-Baggage360/Stored%20Cross-Site%20Scripting%20(XSS).md#http-proof-of-concept-poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11308 · Security Note
• https://vuldb.com/?submit.662216 · Note
• https://t.me/cveNotify/137432 · Telegram Post
• https://vuldb.com/?id.327189 · Note
• https://vuldb.com/?ctiid.327189 · Note
• https://twitter.com/CVEnew/status/1974970483800940570 · Twitter Post
• https://t.me/CVEtracker/34192 · Telegram Post