FKIE_CVE-2025-13648

Vulnerability from fkie_nvd - Published: 2026-02-11 09:15 - Updated: 2026-03-17 20:22
Severity
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is required) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Name’ and “Surname” parameters within the ‘My Account’ section at the URL: https://zeus.microcom.es:4040/administracion-estaciones.html  resulting in a stored XSS. This issue affects ZeusWeb: 6.1.31.
References
ffb98d57-deaa-4918-a669-5225ccc13e39https://www.hackrtu.com/blog/CNA-CVE-2025-13648/Third Party Advisory
ffb98d57-deaa-4918-a669-5225ccc13e39https://www.hackrtu.com/blog/CNA-HRTU-0001/Third Party Advisory
ffb98d57-deaa-4918-a669-5225ccc13e39https://www.microcom360.com/servicio-zeus-web/Product
ffb98d57-deaa-4918-a669-5225ccc13e39https://zeus.microcom.es:4040/Permissions Required
Impacted products
Vendor Product Version
microcom360 zeusweb 6.1.31
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microcom360:zeusweb:6.1.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "F47C892A-012D-4BFD-8C7A-36F2AA3E34B8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An attacker with access to the web application ZeusWeb of the provider Microcom\n\n (in this case, registration is required) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the \u2018Name\u2019 and \u201cSurname\u201d parameters within the \u2018My Account\u2019 section at the URL:  https://zeus.microcom.es:4040/administracion-estaciones.html \u00a0resulting in a stored XSS.\nThis issue affects ZeusWeb: 6.1.31."
    },
    {
      "lang": "es",
      "value": "Un atacante con acceso a la aplicaci\u00f3n web ZeusWeb del proveedor Microcom (en este caso, se requiere registro) que tiene el software vulnerable podr\u00eda introducir JavaScript arbitrario inyectando una carga \u00fatil de XSS en los par\u00e1metros \u0027Name\u0027 y \u0027Surname\u0027 dentro de la secci\u00f3n \u0027My Account\u0027 en la URL: https://zeus.microcom.es:4040/administracion-estaciones.html lo que resultar\u00eda en un XSS almacenado.\nEste problema afecta a ZeusWeb: 6.1.31."
    }
  ],
  "id": "CVE-2025-13648",
  "lastModified": "2026-03-17T20:22:55.103",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-11T09:15:49.793",
  "references": [
    {
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.hackrtu.com/blog/CNA-CVE-2025-13648/"
    },
    {
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.hackrtu.com/blog/CNA-HRTU-0001/"
    },
    {
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "tags": [
        "Product"
      ],
      "url": "https://www.microcom360.com/servicio-zeus-web/"
    },
    {
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://zeus.microcom.es:4040/"
    }
  ],
  "sourceIdentifier": "ffb98d57-deaa-4918-a669-5225ccc13e39",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.