Vulnerability · Published Nov 24, 2025 · Assigned by INCIBE

CVE-2025-41087Cross-Site Scripting (XSS) stored in Taclia's web application

Medium 5.1

In plain English

A medium-severity cross-site scripting in Taclia's web application from Taclia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.3%top 76.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cross-Site Scripting (XSS) vulnerability stored in tha Taclia web application, where the uploaded SVG images are not properly sanitized. This allows to the attackers to embed malicious scripts in SVG files such as image profiles, which are then stored on the server and executed in the context of any user who accesses the compromised resource.

Affected products (as reported)

Vendor	Product	Versions
Taclia	Taclia's web application	All versions

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-stored-taclias-web-application