VulnerabilityDeferred

CVE-2025-44024

Cross-Site Scripting (XSS) vulnerability was discovered in the Pichome system v2.1.0 and before.

MEDIUM 6.1EPSS 0.23%

Does this matter?

Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.

Description

Cross-Site Scripting (XSS) vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficient sanitization of user input in the login form. An attacker can inject malicious JavaScript code into the username or password fields during the login process

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.23% probability · 14th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: cve@mitre.org

References

https://github.com/zyx0814/Pichome/issues/50
https://github.com/zyx0814/Pichome/issues/50

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.