Live › vulnerability › CVE-2025-68395
The note editor in ARKETEAM Protectel modules PROTECTELMAJ and BDF does not sanitize note content, so injected HTML and JavaScript are stored. When a user opens that module, the script runs in their browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Teams running ARKETEAM Protectel PROTECTELMAJ or BDF modules with the note editor in use. An attacker needs a low-privilege account to plant a note, and a different user must open that module for the script to run. Installations on the fixed versions are not affected.
No product ranges from the sources yet.
6.5.196.4.67Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
This page as .md · .json · in your agent: get_signal("CVE-2025-68395")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.