VulnSocial

CVE-2025-40638Disclosure(sbitsoft / eventobot)

LOWCVSS 6.1 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A reflected Cross-Site Scripting (XSS) vulnerability has been found in Eventobot. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending him/her a malicious URL using the 'name' parameter in '/search-results'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

sbitsoft CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • eventobot

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 3 classified signals
  • 3 total mentions across 1 day

Affected systems

Vendors
sbitsoft
Products
eventobot

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-03-09: 3Technical Details · 2026-03-09: 203-09
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Full discourse3 posts
  • INCIBE-CERT@incibe_cert
    Disclosure

    ⚠️ #INCIBEaviso | Múltiples vulnerabilidades en #Eventobot #CVE CVE-2025-40638 y CVE-2025-40639 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-eventobot #AvisosDeSeguridad #TI #CNA #0day

    Post summary

    INCIBE issues an early warning about two new CVEs (CVE‑2025‑40638 and CVE‑2025‑40639) affecting Eventobot, but the post provides no proof‑of‑concept, exploit details, patches, or evidence of active exploitation.

    02010503
    42.6K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2025-40638 A reflected Cross-Site Scripting (XSS) vulnerability has been found in Eventobot. This vulnerability allows an attacker to execute JavaScript code in the victim's b… https://www.cve.org/CVERecord?id=CVE-2025-40638

    Post summary

    A reflected XSS vulnerability (CVE‑2025‑40638) has been disclosed for Eventobot, with no exploitation, patch, or PoC details provided.

    00000103
    56.6K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2025-40638 Reflected Cross-Site Scripting Vulnerability in Eventobot Search Results https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-40638

    Post summary

    The entry notes CVE-2025-40638 as a reflected XSS flaw in Eventobot’s search results, providing technical details via a VulMon page but offering no PoC, exploit, or patch information.

    0000046
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appsbitsofteventobot---

Explore more

Back to dashboardsbitsoft CVEseventobot vulnerabilities