CVE-2025-66574

MEDIO 5.4CVE-2025-66574 · Published 04/12/2025 · updated 18/10/2026

In breve

CVE-2025-66574 è una vulnerabilità MEDIO (CVSS 5.4) che riguarda tranzaxis (compassplustechnologies).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.26%, superiore al 18.1% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
tranzaxis compassplustechnologies	`= 3.2.41.10.26`	No fix yet

Description

TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the `Open Object in Tree` endpoint, allowing attackers to steal session cookies and potentially escalate privileges.

References

compassplustechnologies.com · Product
exploit-db.com/exploits/52086 · Exploit
vulncheck.com/advisories/tranzaxis-32411026-stored-cross-site-scripting-xss · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free