CVE-2025-55888

Katalog CVE

CVSS 7.3 · High EPSS 0,44%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada ard gec en ligne. Skor CVSS 3.1 7.3 (High) menurut CISA ADP.

Deskripsi (NVD)

Cross-Site Scripting (XSS) vulnerability was discovered in the Ajax transaction manager endpoint of ARD. An attacker can intercept the Ajax response and inject malicious JavaScript into the accountName field. This input is not properly sanitized or encoded when rendered, allowing script execution in the context of users browsers. This flaw could lead to session hijacking, cookie theft, and other malicious actions.

Rincian

Terbit di NVD

22 September 2025

Terakhir diubah

5 Juli 2026

Status NVD

Modified

CVSS 3.1

7.3 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/0xZeroSec/CVE-2025-55888 exploit
• https://services.ard.fr/?eID=tx_afereload_ajax_transactionmanager product