CVE-2025-62857
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability has been reported in QuMagie. Remote attackers can exploit it to bypass security mechanisms or read application data.
Risk Assessment
This may lead to session data theft, security bypass, and unauthorized access to application information.
Recommendation
Update QuMagie to version 2.8.1 or later, which contains the fix for this vulnerability.
Other vulnerabilities in QuMagie
See all- CVE-2026-50612Critical
A Unix symbolic link (symlink) following vulnerability has been reported in QuMagie. If a remote attacker gains a user account, they can exploit the vulnerability to compromise the security of the system. The vulnerability has been fixed in version 2.9.2 and later.
- CVE-2026-44083Critical
QuMagie contains an authorization bypass vulnerability through a user-controlled key, allowing remote attackers to gain unintended privileges. The vulnerability is fixed in version 2.9.1.
- CVE-2025-52425Critical
An SQL injection vulnerability has been reported to affect QuMagie. A remote attacker can exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: QuMagie 2.7.0 and later.
- CVE-2026-41545High
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
- CVE-2026-26237High
A missing authorization vulnerability in QuMagie allows remote attackers to access unauthorized data or perform unauthorized actions. The issue is fixed in version 2.9.0.
- CVE-2026-26236High
A missing authorization vulnerability in QuMagie allows remote attackers to access unauthorized data or perform unauthorized actions. The issue is fixed in version 2.9.0.
- CVE-2025-58464High
A relative path traversal vulnerability has been reported in QuMagie. A remote attacker can exploit it to read the contents of unexpected files or system data.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QuMagie 2.8.1 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS