Stored XSS Vulnerability in NotesCMS by PrivateAccount
CVE-2025-52037
Currently unrated
What is CVE-2025-52037?
A vulnerability in NotesCMS allows for stored cross-site scripting (XSS) in the service descriptions via the /index.php?route=sites page. This vulnerability is exploitable remotely and was confirmed present in the source code from commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 as of May 8, 2024. It was subsequently addressed in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea on March 31, 2025. Exploitation of this vulnerability enables attackers to manipulate content and potentially compromise user data.