CVE-2025-2715

Summary

CVE-2025-2715 is a newly discovered cross-site scripting vulnerability that impacts timschofield webERP versions up to 5.0.0.rc+13. The flaw, located in the ConfirmDispatch_Invoice.php file of the Confirm Dispatch and Invoice Page component, can be exploited by manipulating the argument Narrative. Attacks can be initiated remotely, making this a serious concern. The exploit has been made public, increasing the risk of attacks. Vendors are urged to apply patches to mitigate the vulnerability, as the affected party has yet to respond to disclosure notices.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.