CVE-2025-13649

MEDIUM

ZeusWeb 6.1.31 - Stored Cross-Site Scripting via Recover Password Email Parameter

Title source: llm
STIX 2.1

Description

An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action must be performed) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Email’ parameters within the ‘Recover password’ section at the URL: https://zeus.microcom.es:4040/index.html?zeus6=true . This issue affects ZeusWeb: 6.1.31.

References (4)

Core 4
Core References
Various Sources technical-description patch
https://www.hackrtu.com/blog/CNA-HRTU-0001/
Various Sources technical-description patch
https://www.hackrtu.com/blog/CNA-CVE-2025-13649/
Various Sources product
https://zeus.microcom.es:4040/

Scores

CVSS v3 6.1
EPSS 0.0023
EPSS Percentile 13.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
Microcom/ZeusWeb 6.1.31
microcom360/zeusweb 6.1.31
Published Feb 11, 2026
Tracked Since Feb 18, 2026