Cross-site Scripting Vulnerability in Jalios JPlatform and Workplace
CVE-2025-25035

7.3HIGH

Key Information:

Vendor

JaliOS

Status
Jplatform
Vendor
CVE Published:
21 March 2025

What is CVE-2025-25035?

A vulnerability in Jalios JPlatform and Jalios Workplace enables attackers to exploit improper input neutralization during web page generation, leading to both reflected and stored cross-site scripting (XSS) attacks. This can allow unauthorized execution of scripts in the context of vulnerable applications, potentially compromising sensitive user data and session information. Versions prior to 10.0.8 (SP8), 10.0.7 (SP7), 10.0.6 (SP6), and several previous iterations of Jalios Workplace are at risk.

Affected Version(s)

JPlatform 0

JPlatform 0 < 10.0.8

JPlatform 0 < 10.0.7

References

https://community.jalios.com/jcms/jc1_893720/en/security-...
https://issues.jalios.com/browse/JCMS-11259
https://issues.jalios.com/browse/JCMS-11246

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arthur Deloffre (Vozec)
Tristan Bizien (Bizi)
.