CVE-2025-29152

Katalog CVE

CVSS 7.6 · High EPSS 0,43%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada lemeconsultoria galera. Skor CVSS 3.1 7.6 (High) menurut CISA ADP.

Deskripsi (NVD)

Cross-Site Scripting vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via multiple components, including Strategic Planning Perspective Registration, Training Request, Perspective Editing, Education Registration, Hierarchical Level Registration, Decision Level Registration, Perspective Registration, Company Group Registration, Company Registration, News Registration, Employee Editing, Goal Team Registration, Learning Resource Type Registration, Learning Resource Family Registration, Learning Resource Supplier Registration, and Cycle Maintenance.

Rincian

Terbit di NVD

7 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.6 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://medium.com/@worzyus/poc-2fd1d2ec1eb9 exploit · advisory pihak ketiga
• https://wellington-almeida.medium.com/poc-2fd1d2ec1eb9 exploit · advisory pihak ketiga