CVE-2025-52036: Exe-system Notescms XSS Vulnerability

CVE-2025-52036 Overview

CVE-2025-52036 is a stored cross-site scripting (XSS) vulnerability in NotesCMS, a lightweight content management system developed by exe-system. The flaw resides in the /index.php?route=categories endpoint, where the application fails to sanitize the title field of service descriptions. An attacker can inject malicious JavaScript that persists in the database and executes in the browser of any user who views the affected page. The vulnerability was introduced in commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (2024-05-08) and remediated in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea (2025-03-31). The issue is classified under [CWE-79] and can be exploited remotely.

Critical Impact
Stored JavaScript payloads execute in the context of authenticated users, enabling session hijacking, credential theft, and unauthorized actions performed on behalf of victims.

Affected Products

exe-system NotesCMS (source code at commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 and earlier)
NotesCMS deployments using the /index.php?route=categories component
All NotesCMS builds prior to commit 95322c5121dbd7070f3bd54f2848079654a0a8ea

Discovery Timeline

2025-08-26 - CVE-2025-52036 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52036

Vulnerability Analysis

The vulnerability is a stored XSS flaw affecting the categories management interface in NotesCMS. When an authenticated user creates or edits a service description, the application accepts the title parameter without applying output encoding or input sanitization. The unsanitized value is written to persistent storage and later rendered directly into HTML when other users navigate to the categories page.

Because the payload persists across sessions, every visitor to the affected page triggers the injected script. The attack requires user interaction (a victim visiting the page) but no privileges beyond the ability to submit category content. The scope change reflected in the CVSS vector indicates the injected script can affect resources outside the vulnerable component, such as session cookies or other browser-accessible data.

Root Cause

The root cause is missing output encoding when rendering user-controlled category title values into the HTML response. The NotesCMS codebase concatenates the stored title field into the response body without applying HTML entity encoding or context-aware escaping. This allows characters such as <, >, and " to break out of their intended text context and introduce active script content.

Attack Vector

An attacker with the ability to create or modify categories submits a crafted title field containing JavaScript payload markup. The payload is stored server-side. When any user, including administrators, loads /index.php?route=categories, the browser parses the injected script and executes it in the origin of the NotesCMS application. This enables theft of session tokens, forced actions via authenticated requests, and content defacement.

The vulnerability mechanism is documented in the vendor issue tracker and a public gist. See the GitHub Issue Discussion and the GitHub Gist Resource for technical details.

Detection Methods for CVE-2025-52036

Indicators of Compromise

Category title values containing HTML tags such as <script>, <img onerror=>, or <svg onload=> stored in the NotesCMS database
Outbound browser requests from users viewing the categories page to unfamiliar external domains
Unexpected session token transmissions in web server or proxy logs originating from /index.php?route=categories

Detection Strategies

Query the NotesCMS database for category records containing angle brackets, javascript: URIs, or event-handler attributes in the title field
Deploy a web application firewall (WAF) rule that inspects POST requests to /index.php?route=categories for XSS payload patterns
Review commit history and confirm the deployed version includes fix commit 95322c5121dbd7070f3bd54f2848079654a0a8ea

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script execution attempts on the NotesCMS origin
Log and alert on administrative account activity immediately following category edits by lower-privileged users
Monitor web server access logs for suspicious GET requests to /index.php?route=categories correlated with anomalous outbound traffic

How to Mitigate CVE-2025-52036

Immediate Actions Required

Update NotesCMS to a build that includes commit 95322c5121dbd7070f3bd54f2848079654a0a8ea or later
Audit existing category records and remove or sanitize any entries containing HTML or script content
Restrict category creation and edit permissions to trusted administrative users until the patch is applied

Patch Information

The upstream fix is available in commit 95322c5121dbd7070f3bd54f2848079654a0a8ea dated 2025-03-31. Administrators should pull the latest source from the NotesCMS repository and redeploy. Refer to the GitHub Issue Discussion for the full remediation context.

Workarounds

Deploy a WAF rule that blocks requests containing common XSS syntax targeting the title parameter on the categories route
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Temporarily disable the categories feature or restrict access to the /index.php?route=categories endpoint via server-level access controls

bash

# Example nginx configuration to enforce CSP and restrict access
location /index.php {
    if ($arg_route = "categories") {
        add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;
        add_header X-XSS-Protection "1; mode=block" always;
    }
    allow 10.0.0.0/8;
    deny all;
}