CVE-2025-63243 Details
Description
A reflected cross-site scripting (XSS) vulnerability exists in the password change functionality of Pixeon WebLaudos 25.1 (01). The sle_sSenha parameter to the loginAlterarSenha.asp file. An attacker can craft a malicious URL that, when visited by a victim, causes arbitrary JavaScript code to be executed in the victim's browser within the security context of the vulnerable application. This issue could allow attackers to steal session cookies, disclose sensitive information, perform unauthorized actions on behalf of the user, or conduct phishing attacks.
A reflected cross-site scripting vulnerability has been identified in Pixeon WebLaudos version 25.1 (01), specifically within the password change feature. The issue arises in the loginAlterarSenha.asp file, where the sle_sLogin parameter is not properly sanitized, allowing attackers to inject malicious JavaScript. When this crafted URL is accessed by a victim, the injected script executes in the context of the application, potentially leading to session cookie theft, unauthorized actions, or phishing attacks.
To address this vulnerability, Pixeon WebLaudos should implement proper input validation and output encoding, especially on login and password-related pages. Additionally, a strong Content Security Policy should be established to block inline scripts and limit executable sources.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 19, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://medium.com/@wagneralves_87750/cve-2025-63243-reflected-cross-site-scripting-in-loginalterarsenha-asp-via-sle-slogin-parameter-53808fbbeeee | [email protected] | ExploitThird Party Advisory |
| https://www.pixeon.com/ | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| pixeon weblaudos | 25.1_(01) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 12, 2026 | Initial Analysis | [email protected] |
| Nov 19, 2025 | CVE Modified | CISA-ADP |
| Nov 19, 2025 | New CVE Received | [email protected] |