{"id":"CVE-2025-34512","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-34512","generatedAt":"2026-10-28T02:23:12.515Z","title":"Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a reflected cross-site scripting (XSS) vulnerability in index.php that allows an unauthenticated attacker to execute arbitrary script in the victim's browser.","description":"Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a reflected cross-site scripting (XSS) vulnerability in index.php that allows an unauthenticated attacker to execute arbitrary script in the victim's browser. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.","published":"2025-10-16T18:15:35.000Z","lastModified":"2026-10-09T10:10:00.000Z","status":"Modified","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":5.1,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-79"],"affected":["ilevia/eve x1 server firmware"],"epss":{"score":0.00407,"percentile":0.34733,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.41%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://www.ilevia.com/","tags":["Product"],"source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ilevia-eve-x1-server-reflected-xss","tags":["Third Party Advisory"],"source":"disclosure@vulncheck.com"},{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5961.php","tags":["Exploit","Third Party Advisory"],"source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-34512","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}