CVE-2025-52035

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-52035
A vulnerability in NotesCMS and specifically in the page /index.php?route=notes. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08) and was fixed in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (dated 2025-03-31). The attack can be launched remotely.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gist.github.com/yA0-Z/54322492b29d7711859913891a7ef988 Third Party Advisory
https://github.com/PrivateAccount/NotesCMS/issues/2 Issue Tracking Patch Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:exe-system:notescms:*:*:*:*:*:*:*:*
History

17 Sep 2025, 17:42

Type Values Removed Values Added
First Time Exe-system
Exe-system notescms
References () https://gist.github.com/yA0-Z/54322492b29d7711859913891a7ef988 - () https://gist.github.com/yA0-Z/54322492b29d7711859913891a7ef988 - Third Party Advisory
References () https://github.com/PrivateAccount/NotesCMS/issues/2 - () https://github.com/PrivateAccount/NotesCMS/issues/2 - Issue Tracking, Patch, Exploit
CPE cpe:2.3:a:exe-system:notescms:*:*:*:*:*:*:*:*

29 Aug 2025, 16:22

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad en NotesCMS, específicamente en la página /index.php?route=notes. La manipulación del título de las descripciones de servicio genera una vulnerabilidad XSS almacenada. Se confirmó la presencia del problema en el código fuente a partir de la commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (con fecha del 08/05/2024) y se corrigió en la commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (con fecha del 31/03/2025). El ataque puede ejecutarse en remoto.

26 Aug 2025, 16:15

Type Values Removed Values Added
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1

26 Aug 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-26 15:15

Updated : 2025-09-17 17:42

NVD link : CVE-2025-52035

Mitre link : CVE-2025-52035

CVE.ORG link : CVE-2025-52035

JSON object : View

Products Affected

exe-system

  • notescms
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')