CVE-2025-52035
Medium
Description
A vulnerability in NotesCMS and specifically in the page /index.php?route=notes. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08) and was fixed in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (dated 2025-03-31). The attack can be launched remotely.
SeverityMedium
CVSS6.1
Exploit probability—
ProductExe-system Notescms
PublishedAug 26, 2025
First seenAug 26, 2025
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- exe-system notescms2025-05-31 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| exe-system notescms | 2024-05-08 ≤ v < 2025-05-31 | 2025-05-31 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.