CVE-2025-15479
Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms ( on Windows and Linux servers ) allows authenticated remote users…
Does this matter?
Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.
Description
Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on all supported platforms ( on Windows and Linux servers ) allows authenticated remote users with survey creation or edit privileges to execute arbitrary JavaScript in other users’ browsers, steal session information and perform unauthorized actions on their behalf via crafted survey content that is rendered without proper output encoding.
- CVSS 4.0
- 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.20% probability · 9th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- ngsurvey/ngsurvey
- Source
- 64c5ae8f-7972-4697-86a0-7ada793ac795
References
- https://cds.thalesgroup.com/en/tcs-cert/CVE-2025-15479Third Party Advisory
- https://docs.ngsurvey.com/installation-setup/change-log#id-3.6.17-2025-05-28Release Notes
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.