CVE-2025-41065
Stored XSS in LUNA v7.5.5.6 via Edit Batch Name Function
Publication date: 2026-02-03
Last updated on: 2026-02-03
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| luna_imaging | software | 7.5.5.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-41065 is a stored Cross-Site Scripting (XSS) vulnerability in LUNA software version 7.5.5.6. It allows an attacker to inject malicious JavaScript code through the 'Edit Batch Name' function. This malicious code is stored by the application and later executed in the browsers of other users who access the affected data, because the application does not properly sanitize the input. [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized execution of JavaScript in users' browsers, which can be exploited to steal sensitive information such as session cookies or to perform actions on behalf of the user without their consent. This can compromise user accounts and data security. [1]
What immediate steps should I take to mitigate this vulnerability?
No official patch or solution has been reported for this vulnerability at this time. Immediate mitigation steps include avoiding use of the 'Edit Batch Name' function to prevent injection of malicious scripts, restricting user privileges to limit who can edit batch names, and monitoring user inputs for suspicious content. Additionally, applying web application firewalls (WAF) rules to detect and block XSS payloads may help reduce risk until a patch is available. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
[{'type': 'paragraph', 'content': "The Stored Cross-Site Scripting (XSS) vulnerability in LUNA software allows attackers to execute malicious JavaScript code in users' browsers, potentially leading to theft of sensitive user data such as session cookies or unauthorized actions on behalf of users."}, {'type': 'paragraph', 'content': 'Such unauthorized access and potential data theft could impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.'}, {'type': 'paragraph', 'content': 'However, no explicit information about the direct impact on compliance with these standards is provided in the available resources.'}] [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know