CVE-2025-13058

A security flaw has been discovered in soerennb eXtplorer up to 2.1.15. The affected element is an unknown function of the component Filename Handler. The manipulation results in cross site scripting. The attack may be launched remotely. The patch is identified as 002def70b985f7012586df2c44368845bf405ab3. Applying a patch is advised to resolve this issue.

CVSS v3 3.5 LOW
CVSS v2.0 4.0 MEDIUM

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/soerennb/extplorer/
https://github.com/soerennb/extplorer/commit/002def70b985f7012586df2c44368845bf405ab3	Patch
https://github.com/soerennb/extplorer/issues/33	Exploit Issue Tracking
https://vuldb.com/?ctiid.332185	Permissions Required VDB Entry
https://vuldb.com/?id.332185	Third Party Advisory US Government Resource
https://vuldb.com/?submit.682370	Third Party Advisory US Government Resource
https://github.com/soerennb/extplorer/issues/33	Exploit Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:extplorer:extplorer:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se ha descubierto una vulnerabilidad de seguridad en soerennb eXtplorer hasta la versión 2.1.15. El elemento afectado es una función desconocida del componente Filename Handler. La manipulación resulta en cross-site scripting. El ataque puede lanzarse remotamente. El parche se identifica como 002def70b985f7012586df2c44368845bf405ab3. Se aconseja aplicar un parche para resolver este problema.

Information

Published : 2025-11-12 20:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-13058

Mitre link : CVE-2025-13058

CVE.ORG link : CVE-2025-13058

JSON object : View

Products Affected

extplorer

extplorer

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-13058", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13058", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T20:37:02.183283Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:extplorer:extplorer:*:*:*:*:*:*:*:*"], "vendor": "soerennb", "modules": ["Filename Handler"], "product": "eXtplorer", "versions": [{"status": "affected", "version": "2.1.0"}, {"status": "affected", "version": "2.1.1"}, {"status": "affected", "version": "2.1.2"}, {"status": "affected", "version": "2.1.3"}, {"status": "affected", "version": "2.1.4"}, {"status": "affected", "version": "2.1.5"}, {"status": "affected", "version": "2.1.6"}, {"status": "affected", "version": "2.1.7"}, {"status": "affected", "version": "2.1.8"}, {"status": "affected", "version": "2.1.9"}, {"status": "affected", "version": "2.1.10"}, {"status": "affected", "version": "2.1.11"}, {"status": "affected", "version": "2.1.12"}, {"status": "affected", "version": "2.1.13"}, {"status": "affected", "version": "2.1.14"}, {"status": "affected", "version": "2.1.15"}]}]}], "published": "2025-11-12T20:15:38.980", "references": [{"url": "https://github.com/soerennb/extplorer/", "source": "cna@vuldb.com"}, {"url": "https://github.com/soerennb/extplorer/commit/002def70b985f7012586df2c44368845bf405ab3", "tags": ["Patch"], "source": "cna@vuldb.com"}, {"url": "https://github.com/soerennb/extplorer/issues/33", "tags": ["Exploit", "Issue Tracking"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.332185", "tags": ["Permissions Required", "VDB Entry"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.332185", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?submit.682370", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cna@vuldb.com"}, {"url": "https://github.com/soerennb/extplorer/issues/33", "tags": ["Exploit", "Issue Tracking"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in soerennb eXtplorer up to 2.1.15. The affected element is an unknown function of the component Filename Handler. The manipulation results in cross site scripting. The attack may be launched remotely. The patch is identified as 002def70b985f7012586df2c44368845bf405ab3. Applying a patch is advised to resolve this issue."}, {"lang": "es", "value": "Se ha descubierto una vulnerabilidad de seguridad en soerennb eXtplorer hasta la versi\u00f3n 2.1.15. El elemento afectado es una funci\u00f3n desconocida del componente Filename Handler. La manipulaci\u00f3n resulta en cross-site scripting. El ataque puede lanzarse remotamente. El parche se identifica como 002def70b985f7012586df2c44368845bf405ab3. Se aconseja aplicar un parche para resolver este problema."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:extplorer:extplorer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4058B09-90F3-4ADD-8B22-ECACF68C3DB9", "versionEndIncluding": "2.1.15"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}