{"id":"CVE-2025-1271","state":"PUBLISHED","title":"Reflected Cross-Site Scripting (XSS) vulnerability in H6Web","description":"Reflected Cross-Site Scripting (XSS) in Anapi Group's h6web. This security flaw could allow an attacker to inject malicious JavaScript code into a URL. When a user accesses that URL, the injected code is executed in their browser, which can result in the theft of sensitive information, identity theft or the execution of unauthorised actions on behalf of the affected user.","publishedAt":"2025-02-13T12:49:40.807Z","updatedAt":"2025-02-13T14:22:02.811Z","severity":{"score":6.1,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"INCIBE"},"assigner":"INCIBE","products":["Anapi Group H6Web"],"affected":[{"vendor":"Anapi Group","product":"H6Web","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected","versionType":"custom"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-anapi-group-h6web"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/1xxx/CVE-2025-1271.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-1271","state":"PUBLISHED","datePublished":"2025-02-13T12:49:40.807Z","dateUpdated":"2025-02-13T14:22:02.811Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2025-02-13T09:18:44.985Z"},"containers":{"cna":{"title":"Reflected Cross-Site Scripting (XSS) vulnerability in H6Web","descriptions":[{"lang":"en","value":"Reflected Cross-Site Scripting (XSS) in Anapi Group's h6web. This security flaw could allow an attacker to inject malicious JavaScript code into a URL. When a user accesses that URL, the injected code is executed in their browser, which can result in the theft of sensitive information, identity theft or the execution of unauthorised actions on behalf of the affected user."}],"affected":[{"vendor":"Anapi Group","product":"H6Web","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected","versionType":"custom"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-anapi-group-h6web"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2025-02-13T12:49:40.807Z"},"credits":[{"lang":"en","type":"finder","value":"Bertrand Lorente Yáñez"}],"datePublic":"2025-02-13T11:00:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The Anapi Group team has taken the following actions: the Insecure Direct Object Reference vulnerability has been completely disabled; the Cross-Site Scripting (XSS) vulnerability has been fixed in the latest version."}],"value":"The Anapi Group team has taken the following actions: the Insecure Direct Object Reference vulnerability has been completely disabled; the Cross-Site Scripting (XSS) vulnerability has been fixed in the latest version."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-13T14:19:21.275754Z","id":"CVE-2025-1271","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-13T14:22:02.811Z"}}]}}}