CVE-2025-2154 — Stored XSS in EchoCCS's Specto CM

Back Back to CVE browser

MEDIUM

Stored XSS in EchoCCS's Specto CM

Published Dec 24, 2025

5.4

MEDIUM

CVSS 3.1

EPSS 0.17%

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Stored XSS.

This issue affects Specto CM: before 17032025.

Affected products

Vendor Echo Call Center Services Trade and Industry Inc. Product Specto CM Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <17032025

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Echo Call Center Services Trade and Industry Inc.

Specto CM

unaffected

Version	Status	Constraints
0	affected	<17032025

Remediation

No remediation recorded yet.

Metrics

0.17% 0.00170

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00170

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.17% (0.00170)	5.70th	v5 (v2026.06.15)
Jun 15, 2026	0.14% (0.00138)	3.49th	v5 (v2026.06.15)
Dec 25, 2025	0.03% (0.00029)	7.63th	v4 (v2025.03.14)

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0480
government-resource
https://www.usom.gov.tr/bildirim/tr-25-0480
government-resourcebroken-link

Link	Providers	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0480		government-resource
https://www.usom.gov.tr/bildirim/tr-25-0480		government-resourcebroken-link