Vulnerability · Published May 26, 2025 · Assigned by INCIBE
CVE-2025-40652Cross-Site Scripting (XSS) in CoverManager
Medium 5.3
In plain English
A medium-severity cross-site scripting in CoverManager from CoverManager. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
Stored Cross-Site Scripting (XSS) vulnerability in the CoverManager booking software. This allows an attacker to inject malicious scripts into the application, which are permanently stored on the server. The malicious scripts are executed in the browser of any user visiting the affected page without the user having to take any further action. This can allow the attacker to steal sensitive information, such as session cookies, login credentials, and perform actions on behalf of the affected user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CoverManager | CoverManager | all versions |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N