PT-2025-47899 · Taclia · Taclia

Published 2025-11-24 · Updated 2025-11-24 · CVE-2025-41087

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Taclia (affected versions not specified)

Description A stored Cross-Site Scripting (XSS) issue exists in the Taclia web application. The application does not properly sanitize uploaded SVG images. This allows attackers to embed malicious scripts within SVG files, such as image profiles, which are then stored on the server. When a user accesses the compromised resource, the malicious script is executed in the user's context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-41087

Affected Products

Taclia

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-41087 · Security Note
• https://t.me/CVEtracker/38065 · Telegram Post
• https://twitter.com/CVEnew/status/1992921769439887800 · Twitter Post
• https://t.me/cveNotify/143765 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-stored-taclias-web-application · Note
• https://twitter.com/VulmonFeeds/status/1992935959399162108 · Twitter Post