CVE-2025-55341
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A Cross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac affects anexos/anexos_nuevo.php via the asocImgRad parameter. The vulnerability allows injection of malicious script that may execute in the user's browser.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser context, potentially leading to session theft or account takeover. The risk affects organizations using Quipux in the specified versions.
Recommendation
Update Quipux to a version that fixes the vulnerability, or implement validation fixes for the asocImgRad parameter. Apply input sanitization mechanisms.
Other vulnerabilities in Quipux
See all- CVE-2025-55343Critical
Quipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via multiple parameters in various PHP files, including busqueda/busqueda.php, anexos_lista.php, Administracion/listas/*.php, asociar_documentos/*.php, radicacion/*.php, reportes/reporte_TraspasoDocFisico.php, tx/*.php, and uploadFiles/cargar_doc_digitalizado_paginador.php.
- CVE-2025-55342Medium
Quipux 4.0.1 through e1774ac allows enumeration of usernames and access to the Ecuadorian identification number for all registered users via the txt_login parameter in Administracion/usuarios/cambiar_password_olvido_validar.php.
Original NVD description (English source)
Cross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac allows anexos/anexos_nuevo.php asocImgRad.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS