Reflected-Xss — CraftedSignal Threat Feed

Tegsoft Online Support Application Reflected XSS Vulnerability (CVE-2025-14320)

hello@craftedsignal.io — Mon, 04 May 2026 09:15:59 +0000

A reflected cross-site scripting (XSS) vulnerability, identified as CVE-2025-14320, exists within the Tegsoft Management and Information Services Trade Limited Company Online Support Application. This vulnerability affects versions V3 through 31122025. An attacker can exploit this vulnerability by injecting malicious scripts into a web page, which is then reflected back to the user, leading to potential data theft, session hijacking, or website defacement. This vulnerability was reported by the Computer Emergency Response Team of the Republic of Turkey. Successful exploitation requires tricking a user into clicking a specially crafted link.

Attack Chain

Attacker crafts a malicious URL containing a JavaScript payload.
The attacker distributes the crafted URL via email, social media, or other means.
Unsuspecting user clicks the malicious URL.
The user’s browser sends a request to the vulnerable Tegsoft Online Support Application with the malicious script as a parameter.
The Tegsoft application fails to properly sanitize the input.
The application reflects the malicious script back to the user’s browser within the HTML response.
The user’s browser executes the malicious script.
The script can then perform actions such as stealing cookies, redirecting the user to a phishing site, or defacing the web page.

Impact

Successful exploitation of this reflected XSS vulnerability can lead to the execution of arbitrary JavaScript code in the context of the victim’s browser. This can result in session hijacking, where an attacker gains unauthorized access to the user’s account. It can also lead to data theft, where sensitive information is stolen from the user’s browser. Furthermore, the attacker can redirect the user to a phishing website or deface the Online Support Application, potentially impacting multiple users.

Recommendation

Apply available patches or updates from Tegsoft to address CVE-2025-14320 on the Online Support Application.
Implement proper input validation and output encoding to prevent XSS vulnerabilities in the application based on CWE-79.
Deploy the provided Sigma rule to detect potential XSS attempts in web server logs.
Educate users about the dangers of clicking on suspicious links to mitigate the initial access vector.

Adobe Connect Reflected XSS Vulnerability (CVE-2026-27245)

hello@craftedsignal.io — Tue, 14 Apr 2026 18:16:55 +0000

A reflected Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-27245, affects Adobe Connect versions 2025.3, 12.10, and earlier. This vulnerability allows an attacker to inject malicious JavaScript code into a user’s browser by convincing them to click on a specially crafted URL. When the victim visits the malicious URL, the injected script executes within their browser session, potentially enabling the attacker to steal cookies, redirect the user to a malicious website, or deface the web page. This vulnerability poses a significant risk to Adobe Connect users, as it can lead to account compromise and data breaches. Exploitation requires user interaction, but the impact can be severe.

Attack Chain

The attacker crafts a malicious URL containing a JavaScript payload within a parameter.
The attacker distributes the crafted URL via email, social media, or other means to a targeted user.
The victim clicks on the malicious link, unknowingly initiating the XSS attack.
The user’s browser sends a request to the Adobe Connect server with the malicious JavaScript in the URL.
The Adobe Connect server reflects the malicious JavaScript code back to the user’s browser without proper sanitization.
The victim’s browser executes the reflected JavaScript code within the context of the Adobe Connect application.
The attacker can then steal the victim’s session cookies.
Using the stolen cookies, the attacker can hijack the victim’s session, gaining unauthorized access to their Adobe Connect account and data.

Impact

Successful exploitation of this reflected XSS vulnerability (CVE-2026-27245) in Adobe Connect could lead to unauthorized access to user accounts, sensitive data, and the Adobe Connect environment. An attacker could potentially deface web pages, redirect users to phishing sites, or inject malware. The impact ranges from user-specific data theft to wider compromise of the Adobe Connect platform. While the number of victims is unknown, any organization using the affected Adobe Connect versions is vulnerable.

Recommendation

Upgrade to a patched version of Adobe Connect that addresses CVE-2026-27245. Refer to the vendor advisory at https://helpx.adobe.com/security/products/connect/apsb26-37.html for specific upgrade instructions.
Deploy the Sigma rule Detect Adobe Connect XSS Attempt via URI to identify requests containing suspicious JavaScript payloads targeting Adobe Connect.
Educate users to be cautious about clicking on URLs received from untrusted sources to mitigate the initial access vector.
Monitor web server logs for unusual URI patterns and JavaScript-like syntax using the Detect Reflected XSS Payloads in URI Sigma rule.

Zootemplate Cerato Theme Reflected XSS Vulnerability (CVE-2025-58920)

hello@craftedsignal.io — Fri, 10 Apr 2026 14:16:25 +0000

A reflected XSS vulnerability, identified as CVE-2025-58920, affects the Zootemplate Cerato WordPress theme. The vulnerability resides in versions ranging from n/a through 2.2.18. It stems from the improper neutralization of input during web page generation, which can allow an attacker to inject malicious scripts into a web page viewed by other users. Successful exploitation could allow an attacker to steal cookies, redirect users to malicious websites, or deface web pages. Given the widespread use of WordPress and its themes, this vulnerability poses a risk to websites using the affected Cerato theme.

Attack Chain

An attacker identifies a vulnerable endpoint within the Cerato theme that does not properly sanitize user input.
The attacker crafts a malicious URL containing a JavaScript payload within a parameter.
The attacker distributes the malicious URL via email, social media, or other means.
A victim clicks the malicious URL, sending a request to the vulnerable WordPress site.
The WordPress server, using the Cerato theme, reflects the attacker’s JavaScript payload in the response without proper sanitization.
The victim’s browser executes the malicious JavaScript code.
The attacker gains the ability to perform actions on behalf of the victim, such as stealing cookies or redirecting the user.

Impact

Successful exploitation of this reflected XSS vulnerability can lead to several adverse effects. An attacker could steal a user’s session cookies, gaining unauthorized access to their account. Victims can be redirected to phishing sites, potentially compromising their credentials. Further, attackers might inject malicious content into the web page, defacing the site or spreading malware. The impact of this vulnerability is limited by the need for user interaction (clicking a malicious link), but the potential for widespread exploitation remains significant for sites using the vulnerable Cerato theme.

Recommendation

Upgrade the Zootemplate Cerato WordPress theme to a version beyond 2.2.18 to remediate CVE-2025-58920.
Deploy the Sigma rule to detect exploitation attempts against this vulnerability (see the “Reflected XSS Attempt via GET” rule below).
Implement a web application firewall (WAF) with rules to detect and block common XSS payloads to mitigate this and similar vulnerabilities.

SiYuan Note Reflected XSS Vulnerability in SVG Processing

hello@craftedsignal.io — Wed, 01 Apr 2026 00:30:01 +0000

SiYuan Note, a note-taking application, is susceptible to a reflected XSS vulnerability in its dynamic icon generation functionality. This flaw, present in versions prior to commit f09953afc57a, arises from an insufficient sanitization of SVG content, specifically failing to account for namespace prefixes in SVG elements. The vulnerability resides in the /api/icon/getDynamicIcon endpoint, which is accessible without authentication. An attacker can exploit this by crafting a malicious SVG payload containing namespaced