CVE-2025-14320
Published: 04 May 2026
Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tegsoft Management and Information Services Trade Limited Company Online Support Application allows Reflected XSS. This issue affects Online Support Application: from V3 through 31122025.
Mitigating Controls (NIST 800-53 r5)AI
Filters information outputs prior to display in web pages, directly neutralizing reflected XSS payloads before they execute in users' browsers.
Validates the content of user inputs to the web application, preventing improper neutralization that enables XSS injection.
Requires identification, reporting, and correction of the specific XSS flaw in the Tegsoft Online Support Application across affected versions.
Security SummaryAI
CVE-2025-14320 is an improper neutralization of input during web page generation vulnerability, classified as reflected cross-site scripting (XSS) under CWE-79, affecting the Tegsoft Management and Information Services Trade Limited Company Online Support Application. The issue impacts versions from V3 through 31122025. Published on 2026-05-04, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no privileges, authentication, or user interaction. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, potentially allowing arbitrary code execution in the context of the affected application.
Mitigation guidance is available in the advisory published by USOM at https://www.usom.gov.tr/bildirim/tr-26-0142.
Details
- CWE(s)