A reflected cross-site scripting (XSS) vulnerability exists in the password change functionality of Pixeon WebLaudos 25.1 (01). The sle_sSenha parameter to the loginAlterarSenha.asp file. An attacker can craft a malicious URL that, when visited by a victim, causes arbitrary JavaScript code to be executed in the victim's browser within the security context of the vulnerable application. This issue could allow attackers to steal session cookies, disclose sensitive information, perform unauthorized actions on behalf of the user, or conduct phishing attacks.
References
| Link | Resource |
|---|---|
| https://medium.com/@wagneralves_87750/cve-2025-63243-reflected-cross-site-scripting-in-loginalterarsenha-asp-via-sle-slogin-parameter-53808fbbeeee | Exploit Third Party Advisory |
| https://www.pixeon.com/ | Product |
Configurations
History
12 Jan 2026, 16:12
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://medium.com/@wagneralves_87750/cve-2025-63243-reflected-cross-site-scripting-in-loginalterarsenha-asp-via-sle-slogin-parameter-53808fbbeeee - Exploit, Third Party Advisory | |
| References | () https://www.pixeon.com/ - Product | |
| First Time |
Pixeon
Pixeon weblaudos |
|
| CPE | cpe:2.3:a:pixeon:weblaudos:25.1_\(01\):*:*:*:*:*:*:* |
19 Nov 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.6 |
| CWE | CWE-79 |
19 Nov 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-19 15:15
Updated : 2026-01-12 16:12
NVD link : CVE-2025-63243
Mitre link : CVE-2025-63243
CVE.ORG link : CVE-2025-63243
JSON object : View
Products Affected
pixeon
- weblaudos
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')