PT-2026-5693 · Luna · Luna

Published 2026-02-02 · Updated 2026-02-03 · CVE-2025-41065

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions LUNA software version 7.5.5.6

Description A stored Cross-Site Scripting (XSS) issue exists in LUNA software. This allows an attacker to execute JavaScript code in a victim’s browser by injecting a malicious payload through the 'Edit Batch Name' function. The payload is stored by the application and displayed without proper sanitization when accessed by other users. This can lead to the theft of sensitive user data, such as session cookies, or actions performed on behalf of the user. The vulnerable function is Edit Batch Name.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the 'Edit Batch Name' function until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-41065

Affected Products

Luna

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-41065 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-luna-luna-imaging · Note
• https://t.me/cveNotify/150707 · Telegram Post
• https://t.me/CVEtracker/43590 · Telegram Post
• https://twitter.com/incibe_cert/status/2018313172722065538 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2018683937363575112 · Twitter Post