PT-2025-49122 · Unknown+1 · Alinto Sogo+1

Arseniy Poblaguev + 1 · Published 2025-01-01 · Updated 2026-01-10 · CVE-2025-63499

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Alinto Sogo version 5.12.3

Description Alinto Sogo 5.12.3 is susceptible to Cross Site Scripting (XSS) attacks. The issue is located in the handling of the theme parameter. Successful exploitation could allow an attacker to inject malicious scripts into web pages viewed by other users.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize or encode the theme parameter to prevent the execution of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-63499

DLA-4434-1

Affected Products

Alinto Sogo

Debian

References · 13

• 🔥 https://github.com/poblaguev-tot/CVE-2025-63499 · Exploit
• https://cve.org/CVERecord?id=CVE-2025-63499 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-63499 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-63499 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-63499 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63499 · Security Note
• https://osv.dev/vulnerability/DLA-4434-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-63499 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-63499 · Vendor Advisory
• https://twitter.com/CVEnew/status/1996668873517551934 · Twitter Post
• https://email.victim.com/SOGo/so/[e-mail]/Mail/view?theme=%27%3CScRiPt%20%3Ealert%289998%29%3C%2FScRiPt%3E · Note
• https://email.example.com/SOGo/so/[e-mail]/Mail/view?theme=%27%3CScRiPt%20%3Ealert%289998%29%3C%2FScRiPt%3E · Note
• https://twitter.com/Cezar_H_Linux/status/2010095211729600586 · Twitter Post