Vulnerability · Published Mar 11, 2025 · Assigned by CERTVDE
CVE-2025-1434XSS in AREAL SAS Topkapi Vision Webserv2
Medium 6.1
In plain English
A medium-severity cross-site scripting in Topkapi Vision Webserv2 from AREAL SAS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.3%top 80.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Spreadsheet view is vulnerable to a XSS attack, where a remote unauthorised attacker can read a limited amount of values or DoS the affected spreadsheet. Disclosure of secrets or other system settings is not affected as well as other spreadsheets still work as expected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AREAL SAS | Topkapi Vision Webserv2 | 1.0.0 – through 6.2.5474 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L
References
- https://www.areal-topkapi.com/en/topkapi/security-bulletins vendor-advisory
- https://www.areal-topkapi.com/topkapi/bulletins-de-securite vendor-advisory