CVE-2025-1175 MEDIUM

CVE-2025-1175: Cross-Site Scripting (XSS) vulnerability in Kelio Visio

Vendor Kelio
Product Kelio Visio 1
Weakness CWE-79 · XSS
Published February 10, 2025
Last update February 12, 2025
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Reflected Cross-Site Scripting (XSS) vulnerability in Kelio Visio 1, Kelio Visio X7 and Kelio Visio X4, in versions between 3.2C and 5.1K. This vulnerability could allow an attacker to execute a JavaScript payload by making a POST request and injecting malicious code into the editable ‘username’ parameter of the ‘/PageLoginVisio.do’ endpoint.

Key dates

02Disclosure timeline

February 10, 2025 CVE published
February 12, 2025 Record updated