CVE-2025-68395
Received Received - Intake

Stored XSS in ARKETEAM Protectel Modules

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: CERT.PL

Description
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2025-68395
EUVD
EUVD-2025-211219

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ARKETEAM PROTECTELMAJ 0
ARKETEAM BDF 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ARKETEAM Protectel modules PROTECTELMAJ and BDF have a note editor with a stored cross-site scripting (XSS) vulnerability. A low-privileged attacker can inject malicious HTML and JavaScript into notes. When a user views these notes, the injected code executes, potentially compromising user sessions or data.

Detection Guidance

This vulnerability involves a Stored XSS in ARKETEAM Protectel modules PROTECTELMAJ and BDF. To detect it, inspect the note editor module in these modules for any injected HTML or JavaScript in notes. Check for unusual scripts or HTML tags in stored notes that could indicate exploitation.

Impact Analysis

This vulnerability allows attackers to steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. Users interacting with the note editor module may unknowingly execute harmful scripts, leading to data theft or unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using affected modules may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Update PROTECTELMAJ to v6.5.19 and BDF to v6.4.67 immediately to patch the vulnerability. If updating is not possible, restrict access to the note editor module or disable it until the update is applied. Monitor notes for suspicious content as a temporary measure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-68395. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart