CVE-2025-71419
Received Received - Intake

Stored XSS in UVdesk Core-Framework

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulnCheck

Description
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2025-71419
EUVD
EUVD-2025-210975

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
uvdesk core-framework to 1.1.7 (exc)
uvdesk community-skeleton to 1.1.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in UVdesk core-framework versions before 1.1.7. Attackers with ROLE_AGENT privileges can inject malicious scripts into the SwiftMailer configuration identifier parameter. The injected scripts are stored and executed when other users access the configuration update page.

Detection Guidance

To detect this vulnerability, inspect the SwiftMailer configuration pages in UVdesk for unusual or malicious scripts in the identifier parameter. Check for stored XSS payloads in the 'id' field of mail configurations. Review server logs for unexpected script executions during page loads.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or deface the application. Users with access to the configuration page may unknowingly execute malicious scripts, leading to unauthorized data access or account compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance violations and penalties if user data is compromised through this XSS flaw.

Mitigation Strategies

Upgrade UVdesk core-framework to version 1.1.7 or later. Validate the 'id' parameter in SwiftMailer.php to only allow alphanumeric characters, underscores, and hyphens. Implement input sanitization for all user-provided data in configuration fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71419. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart