A stored Cross Site Scripting (XSS) vulnherability in the bulletin board (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 allows remote authenticated users to execute arbitrary JavaScript code in the web browser of other users via manipulation of the 'Inhalt' parameter of the '/SchwarzeBrett/Nachrichten/CreateNachricht' or '/SchwarzeBrett/Nachrichten/EditNachricht/' requests.
References
| Link | Resource |
|---|---|
| https://no-sec.net/posts/cve-2025-61074/ | Exploit Third Party Advisory |
| https://www.adata.de/mitarbeiter-portal/ | Product |
Configurations
History
16 Dec 2025, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://no-sec.net/posts/cve-2025-61074/ - Exploit, Third Party Advisory | |
| References | () https://www.adata.de/mitarbeiter-portal/ - Product | |
| CPE | cpe:2.3:a:adata:mitarbeiter_portal:*:*:*:*:*:*:*:* | |
| First Time |
Adata mitarbeiter Portal
Adata |
11 Dec 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.6 |
09 Dec 2025, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-09 16:17
Updated : 2025-12-16 19:17
NVD link : CVE-2025-61074
Mitre link : CVE-2025-61074
CVE.ORG link : CVE-2025-61074
JSON object : View
Products Affected
adata
- mitarbeiter_portal
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')