Stored Cross-Site Scripting in Sergestec's Exito v8.0

CVE-2025-41021

What is CVE-2025-41021?

A stored Cross-Site Scripting (XSS) vulnerability has been identified in Sergestec's Exito v8.0. This issue arises from insufficient validation of user input, allowing an attacker to craft a malicious POST request using the 'obs' parameter in the '/admin/index.php?action=product_update' endpoint. If exploited, this vulnerability can enable a remote user to send specially crafted queries to authenticated users, potentially compromising their cookie session details and thereby threatening the integrity of user accounts.

References