CVE-2025-52035

MEDIUM 6.1CVE-2025-52035 · Published 26/08/2025 · updated 17/06/2026

In short

CVE-2025-52035 is a MEDIUM (CVSS 6.1) vulnerability affecting notescms (exe-system).
Chance of exploitation in the next 30 days (EPSS): 0.21%, higher than 10.8% of all vulnerabilities.
Fix: update to 2025-05-31 or later.

Package	Affected versions	Patched versions
notescms exe-system	`≥ 2024-05-08, < 2025-05-31`	`2025-05-31`

Description

A vulnerability in NotesCMS and specifically in the page /index.php?route=notes. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08) and was fixed in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (dated 2025-03-31). The attack can be launched remotely.

References

gist.github.com/yA0-Z/54322492b29d7711859913891a7ef988 · Third Party Advisory
PrivateAccount/NotesCMS · Exploit

More vulnerabilities in notescms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free