Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Stored Cross-Site Scripting (XSS) vulnerability in Kubysoft, where uploaded SVG images are not properly sanitized. This allows attackers to embed malicious scripts within SVG files as visual content, which are then stored on the server and executed in the context of any user accessing the compromised resource.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-02-16 | 2 | Disclosure2 |
| 2026-03-10 | 1 | Disclosure1 |
CVE-2025-59903 Stored XSS in Kubysoft via Unsanitized SVG Image Upload Mechanism https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-59903
Post summary
The post announces CVE‑2025‑59903 as a stored XSS vulnerability in Kubysoft caused by unsanitized SVG uploads, without providing exploit code, mitigation, or active exploitation evidence.
CVE-2025-59903 Stored Cross-Site Scripting (XSS) vulnerability in Kubysoft, where uploaded SVG images are not properly sanitized. This allows attackers to embed malicious scripts wi… https://www.cve.org/CVERecord?id=CVE-2025-59903
Post summary
The CVE-2025-59903 is a stored XSS flaw in Kubysoft’s SVG upload functionality where uploaded images are not properly sanitized, enabling potential malicious script injection.
🟠 Kubysoft, Stored XSS, #CVE-2025-59903 (MEDIUM) https://dailycve.com/kubysoft-stored-xss-cve-2025-59903-medium/
Post summary
The tweet announces a newly disclosed stored XSS vulnerability, CVE‑2025‑59903, with a medium severity rating. No PoC, exploitation, or patch details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | kubysoft | kubysoft | - | - | - |