CVE-2025-15479 (GCVE-0-2025-15479)

Vulnerability from cvelistv5 – Published: 2026-01-07 13:23 – Updated: 2026-01-07 15:03
VLAI?
Title
NGSurvey Enterprise 3.6.4 incorrect authorization exposes other users’ API keys and personal data
Summary
Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms ( on Windows and Linux servers ) allows authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users’ browsers, steal session information and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding.
Severity ?
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CWE
  • NGSurvey Enterprise 3.6.4 stored XSS via survey content enables arbitrary JavaScript execution
Assigner
References
Impacted products
Vendor Product Version
Data Illusion Zumbrunn NGSurvey Affected: 3.6.4 , < 3.6.17 (semver)
Create a notification for this product.
Credits
Thomas Clair
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15479",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-07T14:10:29.702195Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-07T15:03:22.729Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "user profile management functionality"
          ],
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "NGSurvey",
          "vendor": "Data Illusion  Zumbrunn",
          "versions": [
            {
              "changes": [
                {
                  "at": "3.6.17",
                  "status": "unaffected"
                }
              ],
              "lessThan": "3.6.17",
              "status": "affected",
              "version": "3.6.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:data_illusion_zumbrunn:ngsurvey:*:*:windows:*:*:*:*:*",
                  "versionEndExcluding": "3.6.17",
                  "versionStartIncluding": "3.6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:data_illusion_zumbrunn:ngsurvey:*:*:linux:*:*:*:*:*",
                  "versionEndExcluding": "3.6.17",
                  "versionStartIncluding": "3.6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Clair"
        }
      ],
      "datePublic": "2025-05-28T08:23:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms (\n\non Windows and Linux servers ) allows authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users\u2019 browsers, steal session information and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding."
            }
          ],
          "value": "Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms (\n\non Windows and Linux servers ) allows authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users\u2019 browsers, steal session information and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "NGSurvey Enterprise 3.6.4 stored XSS via survey content enables arbitrary JavaScript execution",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-07T13:23:09.002Z",
        "orgId": "64c5ae8f-7972-4697-86a0-7ada793ac795",
        "shortName": "TCS-CERT"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.ngsurvey.com/installation-setup/change-log#id-3.6.17-2025-05-28"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2025-15479"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2025-05-12T23:41:00.000Z",
          "value": "Vulnerability discovered by the pentester"
        },
        {
          "lang": "en",
          "time": "2025-05-22T07:42:00.000Z",
          "value": "Report submitted to TCS-CERT"
        },
        {
          "lang": "en",
          "time": "2025-05-27T07:45:00.000Z",
          "value": "Vulnerability Report to Vendor through email (support@dataillusion.com)"
        },
        {
          "lang": "en",
          "time": "2025-05-17T07:46:00.000Z",
          "value": "Vendor acknowledged the report and confirmed fixes in v3.6.17"
        },
        {
          "lang": "en",
          "time": "2026-01-07T13:12:00.000Z",
          "value": "CVE ID assigned"
        },
        {
          "lang": "en",
          "time": "2026-01-07T15:12:00.000Z",
          "value": "Vulnerability Disclosure"
        }
      ],
      "title": "NGSurvey Enterprise 3.6.4 incorrect authorization exposes other users\u2019 API keys and personal data",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "64c5ae8f-7972-4697-86a0-7ada793ac795",
    "assignerShortName": "TCS-CERT",
    "cveId": "CVE-2025-15479",
    "datePublished": "2026-01-07T13:23:09.002Z",
    "dateReserved": "2026-01-07T13:10:13.147Z",
    "dateUpdated": "2026-01-07T15:03:22.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-15479\",\"sourceIdentifier\":\"64c5ae8f-7972-4697-86a0-7ada793ac795\",\"published\":\"2026-01-07T14:15:53.280\",\"lastModified\":\"2026-01-08T18:08:54.147\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms (\\n\\non Windows and Linux servers ) allows authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users\u2019 browsers, steal session information and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"64c5ae8f-7972-4697-86a0-7ada793ac795\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://cds.thalesgroup.com/en/tcs-cert/CVE-2025-15479\",\"source\":\"64c5ae8f-7972-4697-86a0-7ada793ac795\"},{\"url\":\"https://docs.ngsurvey.com/installation-setup/change-log#id-3.6.17-2025-05-28\",\"source\":\"64c5ae8f-7972-4697-86a0-7ada793ac795\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-15479\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-07T14:10:29.702195Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-07T14:10:33.597Z\"}}], \"cna\": {\"title\": \"NGSurvey Enterprise 3.6.4 incorrect authorization exposes other users\\u2019 API keys and personal data\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Thomas Clair\"}], \"impacts\": [{\"capecId\": \"CAPEC-63\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-63 Cross-Site Scripting (XSS)\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Data Illusion  Zumbrunn\", \"modules\": [\"user profile management functionality\"], \"product\": \"NGSurvey\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"3.6.17\", \"status\": \"unaffected\"}], \"version\": \"3.6.4\", \"lessThan\": \"3.6.17\", \"versionType\": \"semver\"}], \"platforms\": [\"Windows\", \"Linux\"], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2025-05-12T23:41:00.000Z\", \"value\": \"Vulnerability discovered by the pentester\"}, {\"lang\": \"en\", \"time\": \"2025-05-22T07:42:00.000Z\", \"value\": \"Report submitted to TCS-CERT\"}, {\"lang\": \"en\", \"time\": \"2025-05-27T07:45:00.000Z\", \"value\": \"Vulnerability Report to Vendor through email (support@dataillusion.com)\"}, {\"lang\": \"en\", \"time\": \"2025-05-17T07:46:00.000Z\", \"value\": \"Vendor acknowledged the report and confirmed fixes in v3.6.17\"}, {\"lang\": \"en\", \"time\": \"2026-01-07T13:12:00.000Z\", \"value\": \"CVE ID assigned\"}, {\"lang\": \"en\", \"time\": \"2026-01-07T15:12:00.000Z\", \"value\": \"Vulnerability Disclosure\"}], \"datePublic\": \"2025-05-28T08:23:00.000Z\", \"references\": [{\"url\": \"https://docs.ngsurvey.com/installation-setup/change-log#id-3.6.17-2025-05-28\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://cds.thalesgroup.com/en/tcs-cert/CVE-2025-15479\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms (\\n\\non Windows and Linux servers ) allows authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users\\u2019 browsers, steal session information and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms (\\n\\non Windows and Linux servers ) allows authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users\\u2019 browsers, steal session information and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"NGSurvey Enterprise 3.6.4 stored XSS via survey content enables arbitrary JavaScript execution\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:data_illusion_zumbrunn:ngsurvey:*:*:windows:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"3.6.17\", \"versionStartIncluding\": \"3.6.4\"}, {\"criteria\": \"cpe:2.3:a:data_illusion_zumbrunn:ngsurvey:*:*:linux:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"3.6.17\", \"versionStartIncluding\": \"3.6.4\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"64c5ae8f-7972-4697-86a0-7ada793ac795\", \"shortName\": \"TCS-CERT\", \"dateUpdated\": \"2026-01-07T13:23:09.002Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-15479\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-07T15:03:22.729Z\", \"dateReserved\": \"2026-01-07T13:10:13.147Z\", \"assignerOrgId\": \"64c5ae8f-7972-4697-86a0-7ada793ac795\", \"datePublished\": \"2026-01-07T13:23:09.002Z\", \"assignerShortName\": \"TCS-CERT\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.