PT-2026-22592 · Skrol29 · Tbszip

Published 2026-03-02 · Updated 2026-03-02 · CVE-2025-65465

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Skrol29 TbsZip versions 2.17 and earlier

Description A reflected Cross-Site Scripting (XSS) issue exists in the RaiseError function of Skrol29 TbsZip. The issue occurs because error messages are not properly sanitized before being displayed to the user. This allows a remote attacker to execute arbitrary web script or HTML by providing a crafted payload within a filename parameter, such as when used with the FileRead function.

Recommendations Update to version 2.18 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65465

Affected Products

Tbszip

References · 8

• https://osv.dev/vulnerability/CVE-2025-65465 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65465 · Security Note
• https://github.com/Skrol29/opentbs · Note
• https://github.com/Skrol29/tbszip/releases/tag/v2.18 · Note
• https://github.com/Skrol29/tbszip · Note
• https://gist.github.com/Y-T-T/ad9d05bee5f1fd4569fa5e89583d7304 · Note
• https://t.me/cveNotify/153822 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2028540202579374114 · Twitter Post