Vulnerability-Lookup

GHSA-WVCH-MQ77-2VF3

Vulnerability from github – Published: 2026-02-11 09:30 – Updated: 2026-02-11 09:30

Details

An attacker with access to the web application ZeusWeb of the provider Microcom

(in this case, registration is required) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Name’ and “Surname” parameters within the ‘My Account’ section at the URL: https://zeus.microcom.es:4040/administracion-estaciones.html resulting in a stored XSS. This issue affects ZeusWeb: 6.1.31.

Severity ?

4.8 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-13648"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-11T09:15:49Z",
    "severity": "MODERATE"
  },
  "details": "An attacker with access to the web application ZeusWeb of the provider Microcom\n\n (in this case, registration is required) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the \u2018Name\u2019 and \u201cSurname\u201d parameters within the \u2018My Account\u2019 section at the URL:  https://zeus.microcom.es:4040/administracion-estaciones.html \u00a0resulting in a stored XSS.\nThis issue affects ZeusWeb: 6.1.31.",
  "id": "GHSA-wvch-mq77-2vf3",
  "modified": "2026-02-11T09:30:18Z",
  "published": "2026-02-11T09:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13648"
    },
    {
      "type": "WEB",
      "url": "https://www.hackrtu.com/blog/CNA-CVE-2025-13648"
    },
    {
      "type": "WEB",
      "url": "https://www.hackrtu.com/blog/CNA-HRTU-0001"
    },
    {
      "type": "WEB",
      "url": "https://www.microcom360.com/servicio-zeus-web"
    },
    {
      "type": "WEB",
      "url": "https://zeus.microcom.es:4040"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2025-13648 (GCVE-0-2025-13648)

Vulnerability from cvelistv5 – Published: 2026-02-11 09:05 – Updated: 2026-02-11 15:44

Title

STORED CROSS-SITE SCRIPTING (XSS) ON MICROCOM'S ZEUSWEB

Summary

An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is required) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Name’ and “Surname” parameters within the ‘My Account’ section at the URL: https://zeus.microcom.es:4040/administracion-estaciones.html resulting in a stored XSS. This issue affects ZeusWeb: 6.1.31.

Severity ?

4.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

HackRTU

References

URL

Tags

	https://www.hackrtu.com/blog/CNA-HRTU-0001/	technical-descriptionpatch
	https://www.hackrtu.com/blog/CNA-CVE-2025-13648/	technical-descriptionpatch
	https://www.microcom360.com/servicio-zeus-web/	product
	https://zeus.microcom.es:4040/	product

Impacted products

	Vendor	Product	Version
	Microcom	ZeusWeb	Affected: 6.1.31

Credits

Aarón Flecha Menéndez Víctor Bello Cuevas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13648",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-11T15:37:00.540527Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-11T15:44:22.679Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "ZeusWeb",
          "vendor": "Microcom",
          "versions": [
            {
              "status": "affected",
              "version": "6.1.31"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microcom:zeusweb:6.1.31:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aar\u00f3n Flecha Men\u00e9ndez"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "V\u00edctor Bello Cuevas"
        }
      ],
      "datePublic": "2026-02-11T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An attacker with access to the web application ZeusWeb of the provider Microcom\n\n (in this case, registration is required) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the \u2018Name\u2019 and \u201cSurname\u201d parameters within the \u2018My Account\u2019 section at the URL: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://zeus.microcom.es:4040/administracion-estaciones.html\"\u003ehttps://zeus.microcom.es:4040/administracion-estaciones.html\u003c/a\u003e\u0026nbsp;resulting in a stored XSS.\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eT\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ehis issue affects ZeusWeb: 6.1.31.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "An attacker with access to the web application ZeusWeb of the provider Microcom\n\n (in this case, registration is required) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the \u2018Name\u2019 and \u201cSurname\u201d parameters within the \u2018My Account\u2019 section at the URL:  https://zeus.microcom.es:4040/administracion-estaciones.html \u00a0resulting in a stored XSS.\nThis issue affects ZeusWeb: 6.1.31."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        },
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-11T09:05:07.289Z",
        "orgId": "ffb98d57-deaa-4918-a669-5225ccc13e39",
        "shortName": "HackRTU"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "patch"
          ],
          "url": "https://www.hackrtu.com/blog/CNA-HRTU-0001/"
        },
        {
          "tags": [
            "technical-description",
            "patch"
          ],
          "url": "https://www.hackrtu.com/blog/CNA-CVE-2025-13648/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.microcom360.com/servicio-zeus-web/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://zeus.microcom.es:4040/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The provider has implement the new version\u0026nbsp;6.2.5 which solves the security problems detected in the previous version. The end user does not need to perform any update actions, as the software is cloud-based and managed by the provider, who has implemented the new version for all users."
            }
          ],
          "value": "The provider has implement the new version\u00a06.2.5 which solves the security problems detected in the previous version. The end user does not need to perform any update actions, as the software is cloud-based and managed by the provider, who has implemented the new version for all users."
        }
      ],
      "source": {
        "advisory": "HRTU#0001",
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2025-11-06T11:00:00.000Z",
          "value": "Vulnerability detection by the researchers"
        },
        {
          "lang": "en",
          "time": "2025-11-11T11:00:00.000Z",
          "value": "Report from researchers to the CNA of HackRTU"
        },
        {
          "lang": "en",
          "time": "2025-11-12T15:00:00.000Z",
          "value": "Report from HackRTU CNA to the provider"
        },
        {
          "lang": "en",
          "time": "2026-02-11T09:10:00.000Z",
          "value": "Vulnerabilities published by HackRTU\u0027s CNA"
        }
      ],
      "title": "STORED CROSS-SITE SCRIPTING (XSS) ON MICROCOM\u0027S ZEUSWEB",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ffb98d57-deaa-4918-a669-5225ccc13e39",
    "assignerShortName": "HackRTU",
    "cveId": "CVE-2025-13648",
    "datePublished": "2026-02-11T09:05:07.289Z",
    "dateReserved": "2025-11-25T09:45:45.902Z",
    "dateUpdated": "2026-02-11T15:44:22.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-WVCH-MQ77-2VF3

CVE-2025-13648 (GCVE-0-2025-13648)

Tags

Sightings

Nomenclature