PT-2025-42634 · Unknown · Enterprise Contract Management Portal

Published 2025-10-17 · Updated 2026-03-04 · CVE-2025-56320

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Enterprise Contract Management Portal version 22.4.0

Description The Enterprise Contract Management Portal version 22.4.0 is susceptible to Stored Cross-Site Scripting (XSS) within the chat box component. This allows a remote attacker to execute arbitrary code. The issue involves the injection of malicious scripts that are stored on the target server and subsequently executed in the context of other users' browsers.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider sanitizing all user inputs to the chat box component to prevent the injection of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-56320

Affected Products

Enterprise Contract Management Portal

References · 8

• 🔥 https://medium.com/@rajput.thakur/stored-xss-in-chat-box-component-cve-2025-56320-87fb10d809e2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-56320 · Security Note
• http://cobblestone.com · Note
• https://twitter.com/VulmonFeeds/status/1979320283153445252 · Twitter Post
• https://t.me/CVEtracker/35213 · Telegram Post
• https://t.me/cveNotify/154082 · Telegram Post
• https://twitter.com/CVEnew/status/1979289044451303672 · Twitter Post
• http://enterprise.com · Note