Vulnerabilities

TI-2025-23971 CVE-2025-32961 · GHSA-hg25-w3vg-7279

CUBA JPA Web API Vulnerable to Cross-Site Scripting (XSS) in the /download Endpoint

LOW 28

The Cuba JPA web API enables loading and saving any entities defined in the application data model by sending simple HTTP requests.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00325 Published 2025-04-22 Fixed in 1.1.1 CWE-79

TI-2025-23970 CVE-2025-32960 · GHSA-88h5-34xw-2q56

LOW 28

The CUBA REST API add-on performs operations on data and entities.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00325 Published 2025-04-22 Fixed in 7.2.7 CWE-79

TI-2025-23969 CVE-2025-32959 · GHSA-w3mp-6vrj-875g

LOW 30

CUBA Platform is a high level framework for enterprise applications development.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00539 Published 2025-04-22 Fixed in 7.2.23 CWE-770