CVE-2025-26127

MEDIUM EPSS 11.6%

Published Mar 17, 20251y ago · Modified Jun 17, 20261w ago

5.0 CVSS 3.1

Medium

Published Mar 17, 2025 1y ago

Last Modified Jun 17, 2026 1w ago

Description

A stored cross-site scripting (XSS) vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

CVSS Details

Base Score

5.0

Exploitability

1.6

Impact

3.4

Vector string

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector Network

Attack Complexity High

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity Low

Availability Low

Threat Intelligence

EPSS Exploit Probability

11.6% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

References 2

github.com https://github.com/pentesttoolscom/vulnerability-research/tree/master/CVE-2025-26127
filecloud.com https://www.filecloud.com/supportdocs/fcdoc/latest/server/release-notes/filecloud-version-23-241-release-notes/minor-filecloud-release-23-241-3

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.