FKIE_CVE-2025-13649

Vulnerability from fkie_nvd - Published: 2026-02-11 09:15 - Updated: 2026-03-17 20:24
Severity
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action must be performed) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Email’ parameters within the ‘Recover password’ section at the URL: https://zeus.microcom.es:4040/index.html?zeus6=true . This issue affects ZeusWeb: 6.1.31.
References
ffb98d57-deaa-4918-a669-5225ccc13e39https://www.hackrtu.com/blog/CNA-CVE-2025-13649/Third Party Advisory
ffb98d57-deaa-4918-a669-5225ccc13e39https://www.hackrtu.com/blog/CNA-HRTU-0001/Third Party Advisory
ffb98d57-deaa-4918-a669-5225ccc13e39https://www.microcom360.com/servicio-zeus-web/Product
ffb98d57-deaa-4918-a669-5225ccc13e39https://zeus.microcom.es:4040/Permissions Required
Impacted products
Vendor Product Version
microcom360 zeusweb 6.1.31
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microcom360:zeusweb:6.1.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "F47C892A-012D-4BFD-8C7A-36F2AA3E34B8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An attacker with access to the web application\u00a0ZeusWeb of the provider Microcom\n\n (in this case, registration is not necessary, but the action must be performed) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the \u2018Email\u2019 parameters within the \u2018Recover password\u2019 section at the URL:  https://zeus.microcom.es:4040/index.html?zeus6=true . This issue affects ZeusWeb: 6.1.31."
    },
    {
      "lang": "es",
      "value": "Un atacante con acceso a la aplicaci\u00f3n web ZeusWeb del proveedor Microcom (en este caso, no es necesario registrarse, pero la acci\u00f3n debe realizarse) que tenga el software vulnerable podr\u00eda introducir JavaScript arbitrario inyectando una carga \u00fatil XSS en los par\u00e1metros \u0027Email\u0027 dentro de la secci\u00f3n \u0027Recuperar contrase\u00f1a\u0027 en la URL: https://zeus.microcom.es:4040/index.html?zeus6=true. Este problema afecta a ZeusWeb: 6.1.31."
    }
  ],
  "id": "CVE-2025-13649",
  "lastModified": "2026-03-17T20:24:13.760",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-11T09:15:49.997",
  "references": [
    {
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.hackrtu.com/blog/CNA-CVE-2025-13649/"
    },
    {
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.hackrtu.com/blog/CNA-HRTU-0001/"
    },
    {
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "tags": [
        "Product"
      ],
      "url": "https://www.microcom360.com/servicio-zeus-web/"
    },
    {
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://zeus.microcom.es:4040/"
    }
  ],
  "sourceIdentifier": "ffb98d57-deaa-4918-a669-5225ccc13e39",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.