CVE-2025-66574

MEDIUM 5.4CVE-2025-66574 · Published 04/12/2025 · updated 18/10/2026

In short

CVE-2025-66574 is a MEDIUM (CVSS 5.4) vulnerability affecting tranzaxis (compassplustechnologies).
Chance of exploitation in the next 30 days (EPSS): 0.26%, higher than 18.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
tranzaxis compassplustechnologies	`= 3.2.41.10.26`	No fix yet

Description

TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the `Open Object in Tree` endpoint, allowing attackers to steal session cookies and potentially escalate privileges.

References

compassplustechnologies.com · Product
exploit-db.com/exploits/52086 · Exploit
vulncheck.com/advisories/tranzaxis-32411026-stored-cross-site-scripting-xss · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free