CVE-2025-8461
Published: 03 February 2026
Summary
CVE-2025-8461 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Gov (inferred from references). Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-8461 is an improper neutralization of input during web page generation vulnerability, enabling reflected cross-site scripting (XSS) in Seres Software's syWEB application. Classified under CWE-79, it affects syWEB versions through 03022026. The issue was published on 2026-02-03 with a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H).
Remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no privileges but relying on user interaction, such as clicking a malicious link. Successful exploitation allows attackers to inject and execute arbitrary scripts in the context of a victim's browser, potentially leading to limited disclosure of sensitive information (C:L), limited modification of data or behavior (I:L), and high disruption of availability (A:H).
The primary advisory is available from USOM at https://www.usom.gov.tr/bildirim/tr-26-0013. The vendor was contacted early regarding this disclosure but did not respond, and no patches or mitigations are mentioned in available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206659
Vulnerability details
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 03022026. NOTE: The vendor was contacted early about this disclosure but did not respond in…
more
any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing web app directly enables T1190 exploitation and arbitrary JavaScript execution via T1059.007.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates reflected XSS by filtering information prior to output on web pages to prevent execution of injected scripts.
Validates untrusted inputs to the web application, rejecting or sanitizing malicious payloads that could lead to improper neutralization during page generation.
Restricts the types and quantity of inputs accepted by the web application, reducing the attack surface for reflected XSS exploitation.