Medium severity4.6NVD Advisory· Published Dec 9, 2025· Updated Jun 17, 2026

CVE-2025-61074

Description

A stored Cross Site Scripting (XSS) vulnerability in the bulletin board (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 allows remote authenticated users to execute arbitrary JavaScript code in the web browser of other users via manipulation of the 'Inhalt' parameter of the '/SchwarzeBrett/Nachrichten/CreateNachricht' or '/SchwarzeBrett/Nachrichten/EditNachricht/' requests.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

adata Software GmbH/Mitarbeiter Portalllm-fuzzy2 versions
= 2.15.2.0+ 1 more
- (no CPE)range: = 2.15.2.0
- (no CPE)
Adata/Mitarbeiterportal
cpe:2.3:a:adata:mitarbeiter_portal:*:*:*:*:*:*:*:*
Range: <2.16.1

Patches

Vulnerability mechanics

References

no-sec.net/posts/cve-2025-61074/nvdExploitThird Party Advisory
www.adata.de/mitarbeiter-portal/nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.299
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000