Description

A vulnerability in NotesCMS and specifically in the page /index.php?route=notes. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (dated 2024-05-08) and was fixed in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (dated 2025-03-31). The attack can be launched remotely.

INFO

Published Date :

2025-08-26T00:00:00.000Z

Last Modified :

2025-08-26T15:27:13.375Z

Source :

mitre
AFFECTED PRODUCTS

The following products are affected by CVE-2025-52035 vulnerability.

Vendors Products
Exe-system
  • Notescms
Notescms Project
  • Notescms
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-52035.

URL Resource
https://gist.github.com/yA0-Z/54322492b29d7711859913891a7ef988 cve-icon cve-icon
https://github.com/PrivateAccount/NotesCMS/issues/2 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact