CVE-2025-1271

MEDIUM

Anapi Group h6web - Reflected Cross-Site Scripting via URL Injection

Title source: llm
STIX 2.1

Description

Reflected Cross-Site Scripting (XSS) in Anapi Group's h6web. This security flaw could allow an attacker to inject malicious JavaScript code into a URL. When a user accesses that URL, the injected code is executed in their browser, which can result in the theft of sensitive information, identity theft or the execution of unauthorised actions on behalf of the affected user.

References (1)

Core 1

Scores

CVSS v3 6.1
EPSS 0.0026
EPSS Percentile 17.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
anapi/h6web
Published Feb 13, 2025
Tracked Since Feb 18, 2026