CVE-2025-40648: Stored Cross-Site Scripting (XSS) vulnerability in Issabel products

Published Oct 1, 2025

Updated

Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'numeroconferencia' parameter in '/index.php?menu=conferencia'.

Affected Software

1 affected component

Issabel Issabel

Remediation

Information

The vulnerabilities have been fixed by the Issabel team in the issabel-pbx module version 5.0.0-2 and in the issabel-agenda module version 5.0.0-4.

Event History

Oct 1, 2025

CVE Published

via MITRE·12:30 PM

Data Sourced

via MITRE·12:30 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-40648?

CVE-2025-40648 is considered a high severity vulnerability due to its potential for stored Cross-Site Scripting (XSS) exploitation.

How do I fix CVE-2025-40648?

To fix CVE-2025-40648, ensure proper validation and sanitization of the 'numero_conferencia' parameter to prevent XSS attacks.

What systems are affected by CVE-2025-40648?

CVE-2025-40648 affects Issabel version 5.0.0 and potentially earlier versions.

What type of vulnerability is CVE-2025-40648?

CVE-2025-40648 is a stored Cross-Site Scripting (XSS) vulnerability.

What is the potential impact of exploiting CVE-2025-40648?

Exploitation of CVE-2025-40648 could allow attackers to execute arbitrary scripts in the context of a user's session, leading to data theft or account compromise.