Stored XSS in Veribilim Software's Veribase Order Management
Priority MEDIUM 43CWE-116Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, CWE - 83 Improper Neutralization of Script in Attributes in a Web Page vulnerability in Veribilim Software Veribase Order allows Stored XSS, Cross-Site Scripting (XSS), Exploit Script-Based APIs, XSS Through HTTP Headers. This issue affects Veribase Order: before v4.010.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00414 35th percentileScored 2026-11-07
Fix Fixed Veribase Order (Veribilim Software): v4.010.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Veribilim Software | Veribase Order | before v4.010.3 | v4.010.3 | Patch available | CNA |
- Veribase Order VendorVeribilim Software Affected before v4.010.3 Fixed in v4.010.3 Patch available CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:veribilim_software:veribase_order_management:*:*:*:*:*:*:*:* | — | — | Veribilim Software |
- cpe:2.3:a:veribilim_software:veribase_order_management:*:*:*:*:*:*:*:* Versions — — ·Veribilim Software
Remediation
- Fix · CNA Veribase Order (Veribilim Software) Fixed in v4.010.3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-7873
- 2026-10-03 Alias added: GHSA-2rr2-57v3-7cvx
References
Sources
- CVE-2024-7873 · CVE Program
- CVE-2024-7873 · NVD
- FIRST EPSS
- GHSA-2rr2-57v3-7cvx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences