CVE-2025-25035: Jalios JPlatform 10 Multiple Cross-Site Scripting (XSS)

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-21 · updated 2026-06-17
Weakness: CWE-79

Description

Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.This issue affects JPlatform 10: before 10.0.8 (SP8), before 10.0.7 (SP7), before 10.0.6 (SP6) and Jalios Workplace 6.2, Jalios Workplace 6.1, Jalios Workplace 6.0, and Jalios Workplace 5.3 to 5.5

Affected products

Jalios JPlatform: before 10.0.8; before 10.0.7; before 10.0.6 — fixed in 10.0.6, 10.0.7, 10.0.8

How to fix

Upgrade to a fixed version: Jalios JPlatform 10.0.6, 10.0.7, 10.0.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-25035 or the next vulnerability affects your stack