Cross-Site Scripting (XSS) stored in Taclia's web application
Taclia's web application.
INCIBE has coordinated the publication of 1 medium-severity vulnerability that affects the web application of Taclia, a Website for the management of PYMES and freelancers. This vulnerability was discovered by Miguel Jiménez Cámara.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type:
- CVE-2025-41087: CVSS v4.0: 5.1| CVSS AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | CWE-79
The vulnerability has been fixed by the Taclia team in the last version.
CVE-2025-41087: Cross-Site Scripting (XSS) vulnerability stored in tha Taclia web application, where the uploaded SVG images are not properly sanitized. This allows to the attackers to embed malicious scripts in SVG files such as image profiles, which are then stored on the server and executed in the context of any user who accesses the compromised resource.
