CVE-2025-25035: Jalios JPlatform 10 Multiple Cross-Site Scripting (XSS)
Description
Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.This issue affects JPlatform 10: before 10.0.8 (SP8), before 10.0.7 (SP7), before 10.0.6 (SP6) and Jalios Workplace 6.2, Jalios Workplace 6.1, Jalios Workplace 6.0, and Jalios Workplace 5.3 to 5.5
Classification
CVE ID: CVE-2025-25035
CVSS Base Severity: HIGH
CVSS Base Score: 7.3
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Problem Types
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')Affected Products
Vendor: Jalios
Product: JPlatform
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 9.53% (scored less or equal to compared to others)
EPSS Date: 2025-04-18 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: none
SSVC Technical Impact: total
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2025-25035https://community.jalios.com/jcms/jc1_893720/en/security-alert-2025-02-19
https://issues.jalios.com/browse/JCMS-11259
https://issues.jalios.com/browse/JCMS-11246
https://issues.jalios.com/browse/JCMS-11248
https://vulncheck.com/advisories/jalios-jplatform-xss