CVE-2025-0930 MEDIUM

CVE-2025-0930: Reflected Cross-Site Scripting (XSS) vulnerability in TeamCal Neo

Vendor Lewe
Product TeamCal Neo
Weakness CWE-79 · XSS
Published January 31, 2025
Last update January 31, 2025
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Reflected Cross-Site Scripting (XSS) in TeamCal Neo, version 3.8.2. This allows an attacker to execute malicious JavaScript code, after injecting code via the ‘abs’ parameter in ‘/teamcal/src/index.php’.

Key dates

02Disclosure timeline

January 31, 2025 CVE published
January 31, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-51828 WordPress Beacon For Help Scout plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-1598 Bdtask Bhojon All-In-One Restaurant Management System User Information profile cross site scripting CVE-2024-43351 WordPress Bravada theme <= 1.1.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-34623 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) CVE-2025-1196 code-projects Real Estate Property Management System search.php cross site scripting