Vulnerability · Published Oct 30, 2025 · Assigned by CERT-PL

CVE-2025-10348Stored Cross-Site Scripting in URVE Smart Office

Medium 5.1

In plain English

A medium-severity cross-site scripting in URVE Smart Office from Eveo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.4%top 70.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

URVE Smart Office is vulnerable to Stored XSS in report problem functionality. An attacker with a low-privileged account can upload an SVG file containing a malicious payload, which will be executed when a victim visits the URL of the uploaded resource. The resource is available to anyone without any form of authentication. This issue was fixed in version 1.1.24.

Affected products (as reported)

Vendor	Product	Versions
Eveo	URVE Smart Office	0 – before 1.1.24

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://cert.pl/posts/2025/10/CVE-2025-10348 third-party-advisory
https://smartoffice.expert/ product