PT-2026-1656 · Data Illusion · Zumbrunn Ngsurvey Enterprise Edition

Thomas Clair · Published 2026-01-07 · Updated 2026-01-29 · CVE-2025-15479

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Data Illusion Zumbrunn NGSurvey Enterprise Edition version 3.6.4

Description The software contains a stored cross-site scripting issue. This affects the survey content and administration functionality, allowing authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users’ browsers. This could lead to session information theft and unauthorized actions. The issue occurs because crafted survey content is rendered without proper output encoding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-15479

Affected Products

Zumbrunn Ngsurvey Enterprise Edition

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-15479 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15479 · Vendor Advisory
• https://docs.ngsurvey.com/installation-setup/change-log#id-3.6.17-2025-05-28 · Vendor Advisory
• https://twitter.com/CVEnew/status/2008900742787076564 · Twitter Post
• https://t.me/CVEtracker/41608 · Telegram Post
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2025-15479 · Note
• https://t.me/cveNotify/150228 · Telegram Post