CVE-2025-52037

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-52037
A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08), and was fixed in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (dated 2025-03-31). The attack can be launched remotely. CWE Definition of the Vulnerability: CWE-79.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gist.github.com/yA0-Z/eb6cd89398abff716c70866fa873dbde Third Party Advisory
https://github.com/PrivateAccount/NotesCMS/issues/3 Issue Tracking Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:exe-system:notescms:2024-05-08:*:*:*:*:*:*:*
History

16 Sep 2025, 19:15

Type Values Removed Values Added
References () https://gist.github.com/yA0-Z/eb6cd89398abff716c70866fa873dbde - () https://gist.github.com/yA0-Z/eb6cd89398abff716c70866fa873dbde - Third Party Advisory
References () https://github.com/PrivateAccount/NotesCMS/issues/3 - () https://github.com/PrivateAccount/NotesCMS/issues/3 - Issue Tracking, Patch
First Time Exe-system notescms
Exe-system
CPE cpe:2.3:a:exe-system:notescms:2024-05-08:*:*:*:*:*:*:*

29 Aug 2025, 16:22

Type Values Removed Values Added
Summary
  • (es) Se ha detectado una vulnerabilidad en NotesCMS, clasificada como de gravedad media. Esta vulnerabilidad afecta a la página /index.php?route=sites. La manipulación del título de las descripciones de servicio genera una vulnerabilidad XSS almacenada. Se confirmó la presencia del problema en el código fuente a partir de la commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (con fecha del 08/05/2024) y se corrigió en la commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (con fecha del 31/03/2025). El ataque puede ejecutarse en remoto. Definición de la vulnerabilidad según CWE: CWE-79.

26 Aug 2025, 16:15

Type Values Removed Values Added
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1

26 Aug 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-26 15:15

Updated : 2025-09-16 19:15

NVD link : CVE-2025-52037

Mitre link : CVE-2025-52037

CVE.ORG link : CVE-2025-52037

JSON object : View

Products Affected

exe-system

  • notescms
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')