5.1
MediumCVSS 4.0 · from CERT-PL
CVE-2025-68395
Stored XSS in Protectel
PROTECTELMAJ · Cross-site scripting · CWE-79AffectedPROTECTELMAJ, BDF
FixUpdate to 6.5.19, 6.4.67 or newer
PublishedOct 30, 11:37 · CERT-PL
ScoredOct 30 · 5.1 · CERT-PL
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker has to be on the same network. CVSS: adjacent network.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
From CERT-PL
Affected and fixed versions
ProductAffectedFixed inPROTECTELMAJbefore 6.5.196.5.19BDFbefore 6.4.676.4.67
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known