PT-2025-44401 · Unknown · Urve Smart Office

Anna Błaszczak + 1 · Published 2025-10-30 · Updated 2025-10-30 · CVE-2025-10348

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions URVE Smart Office versions prior to 1.1.24

Description URVE Smart Office is susceptible to a Stored Cross-Site Scripting (XSS) issue within the report problem functionality. An attacker possessing a low-privileged account can upload a Scalable Vector Graphics (SVG) file containing a malicious payload. Upon a victim accessing the URL of the uploaded resource, the malicious payload is executed. The resource is accessible to anyone without requiring authentication.

Recommendations Upgrade to version 1.1.24 or later to address this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-10348

Affected Products

Urve Smart Office

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-10348 · Security Note
• https://t.me/CVEtracker/36181 · Telegram Post
• https://t.me/cveNotify/140940 · Telegram Post
• https://smartoffice.expert · Note
• https://cert.pl/posts/2025/10/CVE-2025-10348 · Note