CVE-2025-59467

Опубликовано: 05 янв. 2026

Источник: nvd

CVSS3: 7.5

CVSS3: 9.6

EPSS Низкий

Описание

This plugin is disabled by default.

Affected Products: UCRM Argentina AFIP invoices Plugin (Version 1.2.0 and earlier)

Mitigation: Update UCRM Argentina AFIP invoices Plugin to Version 1.3.0 or later.

Ссылки

https://community.ui.com/releases/Security-Advisory-Bulletin-057/6d3f2a51-22b8-47a1-9296-1e9dcd64e073
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ui:argentina_afip_invoices:*:*:*:*:*:ucrm:*:*

Версия до 1.3.0 (исключая)

EPSS

Процентиль: 16%

0.0025

Низкий

7.5 High

CVSS3

9.6 Critical

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-436v-ch6r-3qxq

CVSS3: 7.5

github

8 месяцев назад

A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. This plugin is disabled by default. Affected Products: UCRM Argentina AFIP invoices Plugin (Version 1.2.0 and earlier) Mitigation: Update UCRM Argentina AFIP invoices Plugin to Version 1.3.0 or later.

EPSS

Процентиль: 16%

0.0025

Низкий

7.5 High

CVSS3

9.6 Critical

CVSS3

Дефекты

CWE-79