What’s Vulnerable › Vulnerabilities

CVE-2025-64030

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-01 · updated 2026-06-17
• Weakness: CWE-79

Description

Eximbills Enterprise 4.1.5 (Built on 2020-10-30) is vulnerable to authenticated stored cross-site scripting (CWE-79) via the /EximBillWeb/servlets/WSTrxManager endpoint. Unsanitized user input in the TMPL_INFO parameter is stored server-side and rendered to other users, enabling arbitrary JavaScript execution in their browsers.

Affected products

• Chinasystems Eximbills Enterprise: 4.1.5

References

• https://0xy37.medium.com/stored-xss-in-chinasystems-eximbills-enterprise-v4-1-5-f8f5a79c4f0b
• https://chinasystems.com/whatwedo/ee

Get alerted when CVE-2025-64030 or the next vulnerability affects your stack