CVE-2025-10913

Deeper analysis

CVE-2025-10913 is an Improper Neutralization of Input During Web Page Generation vulnerability that enables Cross-Site Scripting (XSS), mapped to CWE-79. It affects the TemizlikYolda application developed by Saastech Cleaning and Internet Services Inc., with the issue present in versions through 11022026.

The vulnerability carries a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H), indicating exploitation over the network with low attack complexity, requiring only low privileges, and no user interaction. Low-privileged authenticated attackers can remotely inject and execute malicious scripts in the context of other users' browsers, potentially leading to low-impact confidentiality violations alongside high-impact integrity and availability disruptions, such as data tampering or service denial within the affected application.

The primary advisory reference is available at https://www.usom.gov.tr/bildirim/tr-26-0055. The vendor was contacted early about this disclosure but provided no response, and no patches or specific mitigations are detailed in the available information.

No real-world exploitation has been reported, and the vendor's lack of response underscores the need for organizations using TemizlikYolda to implement general XSS protections, such as input validation, output encoding, and Content Security Policy, pending any future updates.