Back to Database
Status published
Medium
CVE-2025-48007
Potential XSS in Extension:BlueSpiceAvatars
Vulnerability Description
Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-48007
Credits & Attribution
No credits recorded in the NVD database.
More from Hallo Welt! GmbH
View All →CVE-2025-58114
Potential XSS in Extension:CognitiveProcessDesigner
Medium
5.9
CVE-2025-57880
Potential XSS in Extension:BlueSpiceWhoIsOnline
Medium
5.9
CVE-2025-46703
Potential XSS in Extension:AtMentions
Medium
5.9
CVE-2023-42431
Potential XSS on user preferences page
Low
2.1
CVE-2022-42001
Potential XSS in book navigation
Low
3.3
Affected Vendor
Hallo Welt! GmbH
View all reports →Affected Software
BlueSpice
Vulnerable Versions:
5
Timeline
Official Publish:
September 19th, 2025
Last Modified:
September 19th, 2025
Added to House:
July 22nd, 2026