AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2025-40633

UNKNOWN · CVSS N/A EPSS 0.30%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2025-05-20 · Last synced 2026-08-04

CyberRota Analysis

This vulnerability has an unknown severity rating. It affects Java. Exploitation may require the attacker to be authenticated.

CVE
CVE-2025-40633
Severity
UNKNOWN
CVSS
N/A
EPSS
0.30%
Java

Original NVD Description

A Stored Cross-Site Scripting (XSS) vulnerability has been found in Koibox for versions prior to e8cbce2. This vulnerability allows an authenticated attacker to upload an image containing malicious JavaScript code as profile picture in the '/es/dashboard/clientes/ficha/' endpoint