PT-2026-7509 · Microcom · Zeusweb

Published 2026-02-11 · Updated 2026-02-11 · CVE-2025-13650

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZeusWeb version 6.1.31

Description An attacker with access to the ZeusWeb web application can inject arbitrary JavaScript code. This is achieved by injecting an XSS payload into the Surname parameter of the ‘Create Account’ operation. The vulnerable URL is ''https://zeus.microcom.es:4040/index.html?zeus6=true''. No registration is required to perform this action.

Recommendations Apply a fix to the Surname parameter input validation in the ‘Create Account’ operation to prevent the injection of JavaScript code.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-13650

Affected Products

Zeusweb

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13650 · Security Note
• https://hackrtu.com/blog/CNA-HRTU-0001 · Patch
• https://hackrtu.com/blog/CNA-CVE-2025-13650 · Patch
• https://zeus.microcom.es:4040 · Note
• https://microcom360.com/servicio-zeus-web · Note
• https://t.me/cveNotify/151672 · Telegram Post
• https://t.me/CVEtracker/44386 · Telegram Post
• https://twitter.com/CVEnew/status/2021554587065331733 · Twitter Post