CVE-2025-0419

MediumCVSS 4.7/10Last modified Sep 26, 2026

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. Zirve Nova allows Cross-Site Scripting (XSS).

This issue affects Zirve Nova: from 235 through 20250131.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Zirve Information Technologies Inc.	Zirve Nova	>= 235, <= 20250131

References

Timeline

Published: Sep 17, 2025
Last modified: Sep 26, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-04204.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Paraşüt allows CVE-2025-04214.7Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay. T CVE-2025-04228.6An authenticated user in the "bestinformed Web" application can execute commands on the underlying server running the application. (Remote C CVE-2025-04235.3In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site CVE-2025-04245.1In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple authenticated stored cross-site sc CVE-2025-04258.5Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of the "bestinformed Ser CVE-2025-04266.2A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read CVE-2025-04277.8Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture K CVE-2025-04287.2The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via des CVE-2025-04297.2The "AI Power: Complete AI Pack" plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.96 via des CVE-2025-04307.5Belledonne Communications Linphone-Desktop is vulnerable to a NULL Dereference vulnerability, which could allow a remote attacker to creat CVE-2025-04315.8Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypass