Skip to content
OpenAdvisories
Medium · 4.8 CVE-2025-40648 EUVD-2025-32730GHSA-2qqm-fhwf-736x

Stored Cross-Site Scripting (XSS) vulnerability in Issabel products

Published Oct 1, 2025 · Updated Oct 1, 2025 · Assigned by INCIBE

Vendor: issabel-pbx module Vendor: Issabel, issabel-agenda module Product: Issabel Product: Issabel

Description

Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'numero_conferencia' parameter in '/index.php?menu=conferencia'.

Affected products

VendorProductAffectedFixed
issabel-pbx module Issabel < 5.0.0-2 5.0.0-2
Issabel, issabel-agenda module Issabel < 5.0.0-4 5.0.0-4

References