XSS in Issabel, Issabel-Agenda Module Issabel
CVE-2025-40648
Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'numero_conferencia' parameter in '/index.php?menu=conferencia'.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (21.9th percentile) — read the EPSS interpretation.
Affected products
- Issabel, Issabel-agenda Module Issabel — versions 0
- Issabel-pbx Module Issabel — versions 0