Vulnerability · Published Feb 11, 2026 · Assigned by HackRTU

CVE-2025-13649REFLECTED CROSS-SITE SCRIPTING (XSS) ON MICROCOM'S ZEUSWEB

Medium 5.1

In plain English

A medium-severity cross-site scripting in ZeusWeb from Microcom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.3%top 81.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action must be performed) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Email’ parameters within the ‘Recover password’ section at the URL: https://zeus.microcom.es:4040/index.html?zeus6=true . This issue affects ZeusWeb: 6.1.31.

Affected products (as reported)

Vendor	Product	Versions
Microcom	ZeusWeb	6.1.31

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://www.hackrtu.com/blog/CNA-HRTU-0001/ technical-description, patch
https://www.hackrtu.com/blog/CNA-CVE-2025-13649/ technical-description, patch
https://zeus.microcom.es:4040/ product
https://www.microcom360.com/servicio-zeus-web/ product