CVE-2025-13648

MEDIUM

ZeusWeb 6.1.31 - Authenticated Stored Cross-Site Scripting via Name and Surname Parameters

Title source: llm
STIX 2.1

Description

An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is required) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Name’ and “Surname” parameters within the ‘My Account’ section at the URL: https://zeus.microcom.es:4040/administracion-estaciones.html  resulting in a stored XSS. This issue affects ZeusWeb: 6.1.31.

References (4)

Core 4
Core References
Various Sources technical-description patch
https://www.hackrtu.com/blog/CNA-HRTU-0001/
Various Sources technical-description patch
https://www.hackrtu.com/blog/CNA-CVE-2025-13648/
Various Sources product
https://zeus.microcom.es:4040/

Scores

CVSS v3 6.1
EPSS 0.0023
EPSS Percentile 13.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
Microcom/ZeusWeb 6.1.31
microcom360/zeusweb 6.1.31
Published Feb 11, 2026
Tracked Since Feb 18, 2026