PT-2025-6784 · Unknown · Bestinformed Web

David Miller + 1 · Published 2025-02-18 · Updated 2025-02-18 · CVE-2025-0423

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions bestinformed Web (affected versions not specified)

Description The issue arises from improper sanitization of user input in the bestinformed Web application, leading to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker can inject JavaScript code into user sessions, compromising them and potentially abusing the privileges of those users within the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-0423

Affected Products

Bestinformed Web

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-0423 · Security Note
• https://cordaware.com/changelog/en/version-6_4_0_4-release-13_02_2025.html · Vendor Advisory
• https://t.me/cvedetector/18300 · Telegram Post
• https://twitter.com/CVEnew/status/1891764152739168705 · Twitter Post