Read the docs
TI-2025-18707 Aliases CVE-2025-25035GHSA-6fxv-ffp4-g24h

Jalios JPlatform 10 Multiple Cross-Site Scripting (XSS)

Priority LOW 34CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.This issue affects JPlatform 10: before 10.0.8 (SP8), before 10.0.7 (SP7), before 10.0.6 (SP6) and Jalios Workplace 6.2, Jalios Workplace 6.1, Jalios Workplace 6.0, and Jalios Workplace 5.3 to 5.5

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00392 33rd percentileScored 2026-11-07
Fix Fixed JPlatform (Jalios): 10.0.8, 10.0.7, 10.0.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JaliosJPlatformbefore 10.0.8; before 10.0.7; before 10.0.610.0.8, 10.0.7, 10.0.6Patch availableCNA
  • JPlatform VendorJalios Affected before 10.0.8; before 10.0.7; before 10.0.6 Fixed in 10.0.8, 10.0.7, 10.0.6 Patch available CNA

Remediation

  • Fix · CNA JPlatform (Jalios) Fixed in 10.0.8, 10.0.7, 10.0.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-25035
  2. 2026-10-03 Alias added: GHSA-6fxv-ffp4-g24h

References

Other 4

  • TI-2019-13720 Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server… CVSS 3.1CRITICAL 9.8
  • TI-2025-00797 Jalios JPlatform 10 SP6 < 10.0.6 Record Chooser SQL Injection CVSS 3.1HIGH 8.6
  • TI-2025-18708 Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE) CVSS 3.1MEDIUM 6.8
  • TI-2020-12201 jcore/portal/ajaxPortal.jsp in Jalios JCMS 10.0.2 build-20200224104759 allows XSS via the… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences