CVE-2025-8668

Published Feb 11, 2026

Last updated 2 months ago

CVSS critical 9.4
XSS

Overview

Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard allows Reflected XSS. This issue affects Turboard: from 2025.07 before 2026.02.  NOTE: This CVE record updated after the vendor implemented mitigations.
Source
iletisim@usom.gov.tr
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.4
Impact score
5.5
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Severity
CRITICAL

Weaknesses

iletisim@usom.gov.tr
CWE-79

Social media

Hype score
Not currently trending

  1. CVE-2025-8668 Reflected XSS Vulnerability in E-KalSoftwareite Turboard Software Platform Human this title follows the technical security vulnerability, captures the key vulnerability type (product and title case,... https://t.co/ea1xqtnnfz

    @VulmonFeeds

    11 Feb 2026

    38 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  2. [CVE-2025-8668: CRITICAL] Critical Reflected XSS vulnerability in Turboard software by E-Kalite allows attackers to execute malicious scripts. Vendor notified without response. #CyberSecurity#cve,CVE-2025-8668,#cybersecurity https://t.co/0nij4c8MO8

    @CveFindCom

    11 Feb 2026

    66 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. 🔴 CVE-2025-8668 - Critical Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry an... https://t.co/P8B7C4sxCP https://t.co/nGpv23IEuA

    @TheHackerWire

    11 Feb 2026

    64 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flintop Free Gifts for WooCommerce free-gifts-for-woocommerce allows Stored XSS.This issue affects Free Gifts for WooCommerce: from n/a through <= 13.1.0.•CVE-2026-57396
  2. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.•CVE-2026-13320
  3. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch Slider Revolution allows Reflected XSS. This issue affects Slider Revolution: from 7.0.0 through 7.0.16.•CVE-2026-57678
  4. Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.•CVE-2026-54263
  5. ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious link. Scope is changed.•CVE-2026-48307

References

Sources include official advisories and independent security research.