A stored Cross Site Scripting (XSS) vulnerability in the bulletin board (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 allows remote authenticated users to execute arbitrary JavaScript code in the web browser of other users via manipulation of the 'Inhalt' parameter of the '/SchwarzeBrett/Nachrichten/CreateNachricht' or '/SchwarzeBrett/Nachrichten/EditNachricht/' requests.
References
| Link | Resource |
|---|---|
| https://no-sec.net/posts/cve-2025-61074/ | Exploit Third Party Advisory |
| https://www.adata.de/mitarbeiter-portal/ | Product |
Configurations
History
14 Jan 2026, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) A stored Cross Site Scripting (XSS) vulnerability in the bulletin board (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 allows remote authenticated users to execute arbitrary JavaScript code in the web browser of other users via manipulation of the 'Inhalt' parameter of the '/SchwarzeBrett/Nachrichten/CreateNachricht' or '/SchwarzeBrett/Nachrichten/EditNachricht/' requests. |
16 Dec 2025, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:adata:mitarbeiter_portal:*:*:*:*:*:*:*:* | |
| First Time |
Adata mitarbeiter Portal
Adata |
|
| References | () https://no-sec.net/posts/cve-2025-61074/ - Exploit, Third Party Advisory | |
| References | () https://www.adata.de/mitarbeiter-portal/ - Product |
11 Dec 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.6 |
09 Dec 2025, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-09 16:17
Updated : 2026-01-14 15:15
NVD link : CVE-2025-61074
Mitre link : CVE-2025-61074
CVE.ORG link : CVE-2025-61074
JSON object : View
Products Affected
adata
- mitarbeiter_portal
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')