CVE-2025-68395
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low-privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module.
Risk Assessment
A low-privileged attacker can execute arbitrary JavaScript in other users' browsers, potentially hijacking sessions or performing actions on their behalf. The risk affects all users visiting the notes module.
Recommendation
Update PROTECTELMAJ to version 6.5.19 or later and BDF to version 6.4.67 or later. Implement validation and sanitization of note content.
Other vulnerabilities in ARKETEAM Protectel
See all- CVE-2025-68394High
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection. Improper neutralization of input provided by a low privileged user into the "profilInput" parameter allows for SQL Injection attacks. This issue has been fixed in PROTECTELMAJ v6.5.19 and BDF v6.4.67.
- CVE-2025-68393High
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection. Improper neutralization of input provided by a low privileged user into the "Utilisateur" parameter allows for SQL Injection attacks. This issue has been fixed in PROTECTELMAJ v6.5.19 and BDF v6.4.67.
- CVE-2025-68392Medium
ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some functionalities reserved for admin users by forging direct requests to a specific endpoint. This issue has been fixed in PROTECTELMAJ v6.5.19 and BDF v6.4.67.
- CVE-2025-68391Medium
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary files and override existing files in a temporary folder, which might lead to execution of embedded JavaScript scripts when an authenticated user tries to download the uploaded file. This issue has been fixed in PROTECTELMAJ v6.5.19 and BDF v6.4.67.
Original NVD description (English source)
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
Vulnerability data from NVD (NIST) · CISA KEV · EPSS