CVE-2025-50927

MEDIUM EPSS 8.3%

Published Aug 8, 202510mo ago · Modified Jun 17, 20262w ago

6.3 CVSS 3.1

Medium

Published Aug 8, 2025 10mo ago

Last Modified Jun 17, 2026 2w ago

Description

A reflected cross-site scripting (XSS) vulnerability in the List All FTP User Function in EHCP v20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via injecting a crafted payload into the ftpusername parameter.

CVSS Details

Base Score

6.3

Exploitability

2.8

Impact

3.4

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Unchanged

Confidentiality Low

Integrity Low

Availability Low

Threat Intelligence

EPSS Exploit Probability

8.3% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
ehcp	easy_hosting_control_panel	20.04.1.b	any

References 2

packetstorm.news https://packetstorm.news/files/id/207908

Broken Link
ehcp.net https://www.ehcp.net/?p=402

Product

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.