MEDIUM
Stored XSS in Creativeitem Sociopro
Published Oct 2, 2025
5.1
MEDIUMCVSS 4.0
EPSS 0.36%
Description
Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/sociopro/profile/update_profile', affecting to 'name' parameter via POST. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal his/her cookie session details.
Affected products
-
- Version all versionsStatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Creativeitem | Sociopro | unaffected |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (2)
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner INCIBE
Published Oct 2, 2025
Updated Oct 2, 2025
Reserved Apr 16, 2025
Link CVE-2025-40992
CISA Vulnrichment
Updated Oct 2, 2025
ENISA EUVD
EUVD-2025-32664 Assigner INCIBE
Published Oct 2, 2025
Updated Oct 2, 2025
Exploited since n/a
Link EUVD-2025-32664