Stored XSS Vulnerability in UVdesk Core-Framework Affecting SwiftMailer Configurations

CVE-2025-71419

What is CVE-2025-71419?

The UVdesk core-framework prior to version 1.1.7 is vulnerable to a stored cross-site scripting (XSS) issue due to improperly handled user input in the SwiftMailer configuration identifier parameter. User roles designated as ROLE_AGENT can exploit this flaw by injecting malicious scripts into the identifier field. These scripts are then saved and executed when other users access the configuration update page, potentially impacting their accounts and the integrity of the application. Security updates in version 1.1.7 address this vulnerability, highlighting the importance of maintaining updated software to protect against such threats.

References