Vulnerability · Published Oct 16, 2025 · Assigned by VulnCheck

CVE-2025-34512Ilevia EVE X1 Server 4.7.18.0.eden Reflected XSS

Medium 5.1

In plain English

A medium-severity cross-site scripting in EVE X1 Server from Ilevia Srl.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.4%top 64.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a reflected cross-site scripting (XSS) vulnerability in index.php that allows an unauthenticated attacker to execute arbitrary script in the victim's browser. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.

Affected products (as reported)

Vendor	Product	Versions
Ilevia Srl.	EVE X1 Server	0 – through 4.7.18.0.eden

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

https://www.ilevia.com/ product
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5961.php technical-description, exploit
https://www.vulncheck.com/advisories/ilevia-eve-x1-server-reflected-xss third-party-advisory