CVE-2025-9158
The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user. This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.
- Score
- CVSS 4.0 5.3 Medium
- Status
- Deferred - cvd@cert.pl
- Published
- 2025-10-24
- Last modified
- 2026-10-08
- Weaknesses
- CWE-79
Affected products
References
- https://cert.pl/en/posts/2025/10/CVE-2025-9158/
- https://requesttracker.com/request-tracker/
