CVE-2025-2406

Published Dec 25, 2025

Last updated 14 days ago

CVSS high 7.6
Libcurl

Overview

Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Trizbi allows Cross-Site Scripting (XSS). This issue affects Trizbi: before 2.144.4.
Source
iletisim@usom.gov.tr
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.6
Impact score
4.7
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Severity
HIGH

Weaknesses

iletisim@usom.gov.tr
CWE-79

Social media

Hype score
Not currently trending

  1. 📌 Top CVEs recientes (CVSS>=7.0): 1. 🌐 CVE-2025-2406 (CVSS: 7.6) 2. 🌐 CVE-2025-2405 (CVSS: 7.6) 3. 🌐 CVE-2025-2307 (CVSS: 7.6) 4. 📂 CVE-2025-15076 (CVSS: 7.3) 5. 📂 CVE-2025-68916 (CVSS: 9.1) #CyberSecurity #CVE #Infosec

    @DavidMarquet19

    19 Jan 2026

    56 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🟠 CVE-2025-2406 - High Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Trizbi... https://t.co/2IlM0F8Jd9 https://t.co/w5r34UK0OG

    @TheHackerWire

    25 Dec 2025

    47 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 🟠 CVE-2025-2406 - High Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Trizbi... https://t.co/2IlM0F8Jd9 https://t.co/AEN6rErj2e

    @TheHackerWire

    25 Dec 2025

    43 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.•CVE-2026-82208
  2. A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.•CVE-2026-80255
  3. When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.•CVE-2026-8926
  4. When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.•CVE-2026-8927
  5. libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.•CVE-2026-8932

References

Sources include official advisories and independent security research.