CVE-2025-55887
Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD.
Does this matter?
Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject malicious JavaScript code that is executed in the context of a user s browser. This can lead to session hijacking, theft of cookies, and other malicious actions performed on behalf of the victim.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.35% probability · 28th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- ard/gec en ligne
- Source
- cve@mitre.org
References
- https://github.com/0xZeroSec/CVE-2025-55887Exploit, Third Party Advisory
- https://services.ard.fr/index.phpProduct
- https://github.com/0xZeroSec/CVE-2025-55887Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.