7.3high
CVE-2025-25035
Jalios JPlatform 10 Multiple Cross-Site Scripting (XSS)
Published 19 mo ago · modified 4 mo ago · JSON
CVSS
7.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 34%
Public exploits
0
none known
Summary
Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.This issue affects JPlatform 10: before 10.0.8 (SP8), before 10.0.7 (SP7), before 10.0.6 (SP6) and Jalios Workplace 6.2, Jalios Workplace 6.1, Jalios Workplace 6.0, and Jalios Workplace 5.3 to 5.5
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction (EPSS)
0.39% probability of exploitation in the next 30 days, higher than 34% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
Affected products
- Jalios JPlatform
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- community.jalios.com /jcms/jc1_893720/en/security-alert-2025-02-19
- issues.jalios.com /browse/JCMS-11259
- issues.jalios.com /browse/JCMS-11246
- issues.jalios.com /browse/JCMS-11248
- vulncheck.com /advisories/jalios-jplatform-xss
Sources
- CVE List: CVE-2025-25035
- NVD: CVE-2025-25035
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.