CVE-2025-26907

Summary

CVE-2025-26907 is a Cross-site Scripting (XSS) vulnerability affecting Mortgage Calculator Estatik from versions n/a through 2.0.12. An attacker can exploit this weakness by injecting malicious scripts into the application, which could then be executed in a user's browser when they view a specially crafted webpage. The issue arises due to improper neutralization of user input during the web page generation process. Successful exploitation could lead to unauthorized access to sensitive information or the ability to perform actions on behalf of the user. It is essential that users update their Mortgage Calculator Estatik software to a patch or newer version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.