CVE-2025-40647: Stored Cross-Site Scripting (XSS) vulnerability in Issabel products

Published Oct 1, 2025

Updated

Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'email' parameter in '/index.php?menu=addressbook'.

Affected Software

1 affected component

Issabel Issabel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade issabel-pbx to a version that resolves this vulnerability.
Fixed in 5.0.0-2
Upgrade
Upgrade issabel-agenda to a version that resolves this vulnerability.
Fixed in 5.0.0-4

Event History

Oct 1, 2025

CVE Published

via MITRE·12:30 PM

Data Sourced

via MITRE·12:30 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-40647?

CVE-2025-40647 is considered to be a medium severity stored XSS vulnerability.

How do I fix CVE-2025-40647?

To fix CVE-2025-40647, ensure proper input validation and sanitization for the 'email' parameter in the application.

Which versions of Issabel are affected by CVE-2025-40647?

CVE-2025-40647 affects Issabel version 5.0.0.

What type of vulnerability is CVE-2025-40647?

CVE-2025-40647 is a stored Cross-Site Scripting (XSS) vulnerability.

Where is the vulnerability CVE-2025-40647 located?

CVE-2025-40647 is located in the '/index.php?menu=address_book' component of Issabel.