Stored XSS in Datateam's Datactive
Priority LOW 27CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Datateam Information Technologies Inc. Datactive allows Stored XSS. This issue affects Datactive: from 2.13.34 before 2.14.0.6.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00214 11th percentileScored 2026-11-07
Fix Fixed Datactive (Datateam Information Technologies Inc.): 2.14.0.6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Datateam Information Technologies Inc. | Datactive | 2.13.34 to before 2.14.0.6 | 2.14.0.6 | Patch available | CNA |
- Datactive VendorDatateam Information Technologies Inc. Affected 2.13.34 to before 2.14.0.6 Fixed in 2.14.0.6 Patch available CNA
Remediation
- Fix · CNA Datactive (Datateam Information Technologies Inc.) Fixed in 2.14.0.6
Timeline
- 2026-10-02 Threatist record created from CVE-2025-13505
- 2026-10-03 Alias added: GHSA-h9m2-p483-3pqv
References
Sources
- CVE-2025-13505 · CVE Program
- CVE-2025-13505 · NVD
- FIRST EPSS
- GHSA-h9m2-p483-3pqv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences