Stored XSS Vulnerability in ARKETEAM Protectel Modules by ARKETEAM
CVE-2025-68395

5.1MEDIUM

Key Information:

Vendor

Arketeam

Status
Protectelmaj
Bdf
Vendor
CVE Published:
30 October 2026

What is CVE-2025-68395?

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to Stored XSS, allowing low privileged attackers to inject arbitrary HTML and JavaScript into notes. This malicious code can be executed when a user views the affected module, potentially compromising user data and security. It is essential for users of these modules to upgrade to PROTECTELMAJ v6.5.19 and BDF v6.4.67 to mitigate this risk.

Affected Version(s)

BDF 0 < 6.4.67

PROTECTELMAJ 0 < 6.5.19

References

https://protectel.arketeam.com/
product
https://cert.pl/en/posts/2026/10/CVE-2025-68391
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karol Miring
.