PT-2025-47963 · Alinto+1 · Sogo+1

Alexander Klimenko + 1 · Published 2025-11-24 · Updated 2025-12-30 · CVE-2025-63498

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions alinto SOGo version 5.12.3

Description alinto SOGo version 5.12.3 is susceptible to Cross Site Scripting (XSS) attacks. The issue is related to the userName parameter. Exploitation of this issue could allow an attacker to inject malicious scripts into web pages viewed by other users.

Recommendations Apply any available updates or patches for alinto SOGo version 5.12.3 to address the XSS vulnerability in the userName parameter.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-63498

DLA-4386-1

Affected Products

Debian

Sogo

References · 16

• 🔥 https://github.com/xryptoh/CVE-2025-63498 · Exploit
• https://github.com/Alinto/sogo/commit/9e20190fad1a437f7e1307f0adcfe19a8d45184c · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-63498 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4386-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-63498 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-63498 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-63498 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-63498 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-63498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63498 · Security Note
• https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.4 · Note
• https://t.me/cveNotify/147183 · Telegram Post
• https://twitter.com/CVEnew/status/1993057417051947100 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1993138197736415432 · Twitter Post
• https://lists.debian.org/debian-lts-announce/2025/11/msg00029.html · Note