FKIE_CVE-2025-13650

Vulnerability from fkie_nvd - Published: 2026-02-11 09:15 - Updated: 2026-03-20 18:33
Severity
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action must be performed) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Surname’ parameter of the ‘Create Account’ operation at the URL:  https://zeus.microcom.es:4040/index.html?zeus6=true . This issue affects ZeusWeb: 6.1.31.
References
ffb98d57-deaa-4918-a669-5225ccc13e39https://www.hackrtu.com/blog/CNA-CVE-2025-13650/Third Party Advisory
ffb98d57-deaa-4918-a669-5225ccc13e39https://www.hackrtu.com/blog/CNA-HRTU-0001/Third Party Advisory
ffb98d57-deaa-4918-a669-5225ccc13e39https://www.microcom360.com/servicio-zeus-web/Product
ffb98d57-deaa-4918-a669-5225ccc13e39https://zeus.microcom.es:4040/Permissions Required
Impacted products
Vendor Product Version
microcom360 zeusweb 6.1.31
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microcom360:zeusweb:6.1.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "F47C892A-012D-4BFD-8C7A-36F2AA3E34B8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action must be performed) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the \u2018Surname\u2019 parameter of the \u2018Create Account\u2019 operation at the URL:\u00a0 https://zeus.microcom.es:4040/index.html?zeus6=true .\u00a0This issue affects ZeusWeb: 6.1.31."
    },
    {
      "lang": "es",
      "value": "Un atacante con acceso a la aplicaci\u00f3n web ZeusWeb del proveedor Microcom (en este caso, el registro no es necesario, pero la acci\u00f3n debe realizarse) que tiene el software vulnerable podr\u00eda introducir JavaScript arbitrario inyectando una carga \u00fatil XSS en el par\u00e1metro \u0027Surname\u0027 de la operaci\u00f3n \u0027Create Account\u0027 en la URL: https://zeus.microcom.es:4040/index.html?zeus6=true . Este problema afecta a ZeusWeb: 6.1.31."
    }
  ],
  "id": "CVE-2025-13650",
  "lastModified": "2026-03-20T18:33:56.270",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-11T09:15:50.147",
  "references": [
    {
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.hackrtu.com/blog/CNA-CVE-2025-13650/"
    },
    {
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.hackrtu.com/blog/CNA-HRTU-0001/"
    },
    {
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "tags": [
        "Product"
      ],
      "url": "https://www.microcom360.com/servicio-zeus-web/"
    },
    {
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://zeus.microcom.es:4040/"
    }
  ],
  "sourceIdentifier": "ffb98d57-deaa-4918-a669-5225ccc13e39",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "ffb98d57-deaa-4918-a669-5225ccc13e39",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.