← Database

CVE-2025-36558

MEDIUM CVSS: 6.1 Published: 2025-05-01 Modified: 2026-06-17

Description

KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the sso_token used for authentication. If an attacker provides the user with a PiCtory URL containing an HTML script as an sso_token, that script will reply to the user and be executed.

Affected Platforms

Unknown

Weakness Type

CWE-97

References