CVE-2025-61431

MEDIO 6.1CVE-2025-61431 · Published 04/11/2025 · updated 17/06/2026

In breve

CVE-2025-61431 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda infinity zmaintenance (zucchetti), infinity zucchetti (zucchetti).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.20%, superiore al 10.2% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
infinity zmaintenance zucchetti	`≤ 4.1`	No fix yet
infinity zucchetti zucchetti	`≤ 4.1`	No fix yet

Description

A reflected cross-site scripted (XSS) vulnerability in the /jsp/gsfr_feditorHTML.jsp endpoint of Zucchetti ZMaintenance Infinity and Infinity Zucchetti v4.1 and earlier allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into the pHtmlSource parameter. A vendor fix was released on 2025-06-18.

References

gist.github.com/alex-xor/8651dbdd413e4fa7240b0ab1b1845d76 · Third Party Advisory
zucchetti.it · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free