Vulnerability · Published Feb 11, 2026 · Assigned by HackRTU

CVE-2025-13648STORED CROSS-SITE SCRIPTING (XSS) ON MICROCOM'S ZEUSWEB

Medium 4.8

In plain English

A medium-severity cross-site scripting in ZeusWeb from Microcom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 4.0)4.8Medium

Exploit odds (30 days)0.3%top 81.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is required) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Name’ and “Surname” parameters within the ‘My Account’ section at the URL: https://zeus.microcom.es:4040/administracion-estaciones.html resulting in a stored XSS. This issue affects ZeusWeb: 6.1.31.

Affected products (as reported)

Vendor	Product	Versions
Microcom	ZeusWeb	6.1.31

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://www.hackrtu.com/blog/CNA-HRTU-0001/ technical-description, patch
https://www.hackrtu.com/blog/CNA-CVE-2025-13648/ technical-description, patch
https://www.microcom360.com/servicio-zeus-web/ product
https://zeus.microcom.es:4040/ product