Cross-Site Scripting Vulnerability in KUNBUS PiCtory by KUNBUS
CVE-2025-35996
8.5HIGH
What is CVE-2025-35996?
KUNBUS PiCtory versions up to 2.11.1 are vulnerable to a cross-site scripting threat when an authenticated remote attacker manipulates a filename through API endpoints. This manipulated filename can be stored and later displayed to clients without proper sanitization or escaping. As a result, this could allow the attacker to inject malicious HTML script tags, leading to the execution of unauthorized scripts in a user's browser.
Affected Version(s)
Revolution Pi PiCtory 0 <= 2.11.1
References
CVSS V4
Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Adam Bromiley of Pen Test Partners reported these vulnerabilities to CISA.