What’s Vulnerable › Vulnerabilities

CVE-2025-13648: STORED CROSS-SITE SCRIPTING (XSS) ON MICROCOM'S ZEUSWEB

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-11 · updated 2026-06-17
• Weakness: CWE-79

Description

An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is required) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Name’ and “Surname” parameters within the ‘My Account’ section at the URL: https://zeus.microcom.es:4040/administracion-estaciones.html  resulting in a stored XSS. This issue affects ZeusWeb: 6.1.31.

Affected products

• Microcom ZeusWeb: 6.1.31

References

• https://www.hackrtu.com/blog/CNA-CVE-2025-13648/
• https://www.hackrtu.com/blog/CNA-HRTU-0001/
• https://www.microcom360.com/servicio-zeus-web/
• https://zeus.microcom.es:4040/

Get alerted when CVE-2025-13648 or the next vulnerability affects your stack