TI-2025-06296 Aliases CVE-2025-6924 GHSA-77x2-8vcv-5f8r

Reflected XSS in Talent Software's e-BAP

LOW 24CWE-79Published 2025-12-09 · Updated 2026-06-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software e-BAP Automation allows Reflected XSS. This issue affects e-BAP Automation: before 42957.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00188 8th percentileScored 2026-11-07

Fix Fixed e-BAP Automation (Talent Software): 42957

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Talent Software	e-BAP Automation	before 42957	42957	Patch available	CNA

e-BAP Automation VendorTalent Software Affected before 42957 Fixed in 42957 Patch available CNA

Remediation

Fix · CNA e-BAP Automation (Talent Software) Fixed in 42957

Timeline

2026-10-02 Threatist record created from CVE-2025-6924
2026-10-03 Alias added: GHSA-77x2-8vcv-5f8r

References

Other 2

TI-2025-11475 SQLi in Talent Software's UNIS CVSS 3.1CRITICAL 9.8
TI-2024-04333 Strored XSS in Talent Software's BAP Automation CVSS 4.0CRITICAL 9.3
TI-2023-04304 SQLi in Talent Soft's ECOP CVSS 3.1CRITICAL 9.8
TI-2025-09960 XSS in Talent Software's e-Bap CVSS 3.1MEDIUM 5.3
TI-2023-04305 XSS in Talent Soft's ECOP CVSS 3.1MEDIUM 6.1
TI-2023-00306 XSS in Talent Software UNIS CVSS 3.1MEDIUM 6.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences