XSS in Mevzuattr Software's MevzuatTR
Priority LOW 21CWE-1021Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing, Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1021 and CWE-79.
Summary
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Restriction of Rendered UI Layers or Frames vulnerability in Mevzuattr Software MevzuatTR allows Phishing, iFrame Overlay, Clickjacking, Forceful Browsing. This issue needs high privileges. This issue affects MevzuatTR: before 12.02.2025.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0025 16th percentileScored 2026-11-07
Fix Fixed MevzuatTR (Mevzuattr Software): 12.02.2025
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mevzuattr Software | MevzuatTR | before 12.02.2025 | 12.02.2025 | Patch available | CNA |
- MevzuatTR VendorMevzuattr Software Affected before 12.02.2025 Fixed in 12.02.2025 Patch available CNA
Remediation
- Fix · CNA MevzuatTR (Mevzuattr Software) Fixed in 12.02.2025
Timeline
- 2026-10-02 Threatist record created from CVE-2025-0546
- 2026-10-03 Alias added: GHSA-2rjw-w4j8-gc92
References
Sources
- CVE-2025-0546 · CVE Program
- CVE-2025-0546 · NVD
- FIRST EPSS
- GHSA-2rjw-w4j8-gc92 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences