EUVD-2025-35802

ID: EUVD-2025-35802

Severity: medium

CVSS v4: 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N)

CVSS v3: Not provided

CWE: None listed

Source: ENISA

Description

The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user. This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.

Timestamps

Normalized: 2025-12-31T11:32:34Z UTC
Last updated: 2025-12-31T11:31:22Z UTC

References

No references provided.

VulnAI

EUVD-2025-35802

Description

Timestamps

References