CVE-2025-13649

MEDIUM

6.1

Description

An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action must be performed) who has the vulnerable software could introduce arbitrary JavaScript by injecting an XSS payload into the ‘Email’ parameters within the ‘Recover password’ section at the URL: https://zeus.microcom.es:4040/index.html?zeus6=true . This issue affects ZeusWeb: 6.1.31.

CVE Details

CVSS v3.1 Score6.1

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published2/11/2026

Last Modified3/17/2026

Sourcenvd

Honeypot Sightings0

Affected Products

microcom360:zeusweb

Weaknesses (CWE)

CWE-79

References

https://www.hackrtu.com/blog/CNA-CVE-2025-13649/(ffb98d57-deaa-4918-a669-5225ccc13e39)

https://www.hackrtu.com/blog/CNA-HRTU-0001/(ffb98d57-deaa-4918-a669-5225ccc13e39)

https://www.microcom360.com/servicio-zeus-web/(ffb98d57-deaa-4918-a669-5225ccc13e39)

https://zeus.microcom.es:4040/(ffb98d57-deaa-4918-a669-5225ccc13e39)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.