Vulnerabilities ›

CVE-2025-41027

Medium

Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller. These vulnerabilities allows an attacker execute JavaScript code in the victim's browser by sending a malicious URL in 'site' paramet

CWE-79 — Weakness Type

                    Published: Mar 26, 2026                      ·  Modified: Mar 29, 2026                      ·  Source: NVD                

CVSS v3

6.1

🔗 NVD Official

📄 Description (English)

Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller. These vulnerabilities allows an attacker execute JavaScript code in the victim's browser by sending a malicious URL in 'site' parameter in 'app_recuperarclave.php'.

🤖 AI Executive Summary

CVE-2025-41027 is a reflected XSS vulnerability in GDTaller that allows attackers to execute arbitrary JavaScript code through a malicious URL containing a crafted 'site' parameter in app_recuperarclave.php. This vulnerability enables session hijacking, credential theft, and malware distribution to affected users.

📄 Description (Arabic)

ثغرة XSS المنعكسة في GDTaller تسمح للمهاجمين بتنفيذ كود JavaScript عشوائي في متصفح الضحية من خلال معامل 'site' في ملف app_recuperarclave.php. يمكن للمهاجمين استغلال هذه الثغرة لسرقة بيانات اعتماد المستخدمين وخطف الجلسات وتوزيع البرامج الضارة.

🤖 ملخص تنفيذي (AI)

This reflected XSS vulnerability in GDTaller enables attackers to execute JavaScript in victim browsers via malicious URLs with crafted 'site' parameters. Attackers can steal credentials, hijack sessions, and distribute malware to Saudi organizations using this application.

🤖 AI Intelligence Analysis Analyzed: May 23, 2026 02:01

🇸🇦 Saudi Arabia Impact Assessment

Saudi Relevance: high

🏢 Affected Saudi Sectors

banking government healthcare

🎯 MITRE ATT&CK Techniques

T1598.003 T1566.002 T1566.003

⚖️ Saudi Risk Score (AI)

6.0

/ 10.0

🔧 Remediation Steps (English)

Update GDTaller to the latest patched version immediately. Implement input validation and output encoding for all user-supplied parameters, particularly the 'site' parameter. Deploy Web Application Firewall (WAF) rules to detect and block XSS payloads. Conduct security awareness training for users to avoid clicking suspicious links.

🔧 خطوات المعالجة (العربية)

قم بتحديث GDTaller إلى أحدث إصدار مصحح فوراً. طبق التحقق من صحة المدخلات وترميز المخرجات لجميع معاملات المستخدم، خاصة معامل 'site'. نشر قواعد جدار حماية تطبيقات الويب لكشف وحجب حمولات XSS. إجراء تدريب التوعية الأمنية للمستخدمين لتجنب النقر على الروابط المريبة.

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

A.12.6.1 A.14.2.1

🔵 SAMA CSF

ID.GV-2 PR.DS-6 DE.CM-1

🟡 ISO 27001:2022

A.6.2.1 A.14.2.1 A.14.2.5

🔗 References & Sources 1

🔗

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gdtaller

cve-coordination@incibe.es

Third Party Advisory

📦 Affected Products / CPE 1 entries

gdtaller:gdtaller:-

📊 CVSS Score

6.1

/ 10.0 — Medium

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionR — Required

ScopeC — Changed

ConfidentialityL — Low / Local

IntegrityL — Low / Local

AvailabilityN — None / Network

📋 Quick Facts

Severity Medium

CVSS Score6.1

CWECWE-79

Exploit No

Patch ✗ No

Published 2026-03-26

Source Feed nvd

🇸🇦 Saudi Risk Score

6.0

/ 10.0 — Saudi Risk

Priority: MEDIUM

🏷️ Tags

CWE-79

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2025-41027

Introduce Yourself

Sign In Required