CVE-2025-52036

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-52036
A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08), and was fixed in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (dated 2025-03-31). The attack can be launched remotely. CWE Definition of the Vulnerability: CWE-79.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gist.github.com/yA0-Z/aeea5af372fec0085c6a4a7bb9c6bc8e Third Party Advisory
https://github.com/PrivateAccount/NotesCMS/issues/1 Issue Tracking Patch Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:exe-system:notescms:*:*:*:*:*:*:*:*
History

17 Sep 2025, 17:46

Type Values Removed Values Added
First Time Exe-system
Exe-system notescms
CPE cpe:2.3:a:exe-system:notescms:*:*:*:*:*:*:*:*
References () https://gist.github.com/yA0-Z/aeea5af372fec0085c6a4a7bb9c6bc8e - () https://gist.github.com/yA0-Z/aeea5af372fec0085c6a4a7bb9c6bc8e - Third Party Advisory
References () https://github.com/PrivateAccount/NotesCMS/issues/1 - () https://github.com/PrivateAccount/NotesCMS/issues/1 - Issue Tracking, Patch, Exploit

29 Aug 2025, 16:22

Type Values Removed Values Added
Summary
  • (es) Se ha detectado una vulnerabilidad en NotesCMS, clasificada como de gravedad media. Esta vulnerabilidad afecta a la página /index.php?route=categories. La manipulación del título de las descripciones de servicio genera una vulnerabilidad XSS almacenada. Se confirmó la presencia del problema en el código fuente a partir de la commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (con fecha del 08/05/2024) y se corrigió en la commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (con fecha del 31/03/2025). El ataque puede ejecutarse en remoto. Definición de la vulnerabilidad según CWE: CWE-79.

26 Aug 2025, 16:15

Type Values Removed Values Added
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1

26 Aug 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-26 15:15

Updated : 2025-09-17 17:46

NVD link : CVE-2025-52036

Mitre link : CVE-2025-52036

CVE.ORG link : CVE-2025-52036

JSON object : View

Products Affected

exe-system

  • notescms
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')