CVE-2025-9568

MediumCVSS 6.1/10Last modified Sep 30, 2026

Description

The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Sunnet	eHRD CTMS	0

References

https://www.twcert.org.tw/en/cp-139-10357-7de41-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-10356-ea431-1.htmlThird Party Advisory

Timeline

Published: Sep 1, 2025
Last modified: Sep 30, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-95696.1The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitr CVE-2025-95704.9The eHRD CTMS developed by Sunnet has an Arbitrary File Reading vulnerability, allowing remote attackers with administrator privileges to ex CVE-2025-95718.7A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion. A user with permissions to upload artifacts to a Data Fusion CVE-2025-95726.5n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the R CVE-2025-95738.6The ns_backup extension through 13.0.2 for TYPO3 allows command injection.CVE-2025-957410.0Missing Authentication for Critical Function vulnerability in ABB ALS-mini-s4 IP, ABB ALS-mini-s8 IP.This issue affects . All firmware ver CVE-2025-95758.8A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2 CVE-2025-95767.0A vulnerability was identified in seeedstudio ReSpeaker LinkIt7688. Impacted is an unknown function of the file /etc/shadow of the component CVE-2025-95777.0A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0. The affected element is an unknown function of the file /etc/shadow.samp CVE-2025-95787.8Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windo CVE-2025-95798.8A weakness has been identified in LB-LINK BL-X26 1.2.8. The impacted element is an unknown function of the file /goform/set_hidessid_cfg of CVE-2025-95808.8A security vulnerability has been detected in LB-LINK BL-X26 1.2.8. This affects an unknown function of the file /goform/set_blacklist of th