Security Advisory

CVE-2025-40633

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-05-20 10:17:00

Last updated 2025-05-20 13:19:41

Assigner INCIBE

State PUBLISHED

Description

A Stored Cross-Site Scripting (XSS) vulnerability has been found in Koibox for versions prior to e8cbce2. This vulnerability allows an authenticated attacker to upload an image containing malicious JavaScript code as profile picture in the /es/dashboard/clientes/ficha/ endpoint

← Browse all CVEs View on cve.org ↗