{"id":"CVE-2025-8276","aliases":["EUVD-2025-29619","GHSA-m862-4wg2-7pg7"],"status":"published","title":"HTML Injection in Patika Global Technologies' HumanSuite","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Patika Global Technologies HumanSuite allows Cross-Site Scripting (XSS), Phishing.\n\nThis issue affects HumanSuite: before 53.21.0.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00337,"percentile":0.27417,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-116","CWE-74","CWE-79"],"published":"2025-09-16T14:00:24Z","modified":"2026-06-17T10:06:39Z","products":[{"vendor":"patika global technologies","product":"humansuite"}],"references":[{"url":"https://www.usom.gov.tr/bildirim/tr-25-0257","tags":["government-resource","broken-link"]},{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0257","tags":["government-resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8276"},{"url":"https://github.com/advisories/GHSA-m862-4wg2-7pg7"}],"sources":{"cve":[{"id":"CVE-2025-8276","title":"HTML Injection in Patika Global Technologies' HumanSuite","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Patika Global Technologies HumanSuite allows Cross-Site Scripting (XSS), Phishing.\n\nThis issue affects HumanSuite: before 53.21.0.","status":"published","published":"2025-09-16T14:00:24.663Z","modified":"2026-06-05T11:41:27.669Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-79","CWE-116","CWE-74"],"updated_at":"2026-11-02T14:32:38.025852Z"}],"euvd":[{"id":"EUVD-2025-29619","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Patika Global Technologies HumanSuite allows Cross-Site Scripting (XSS), Phishing.\n\nThis issue affects HumanSuite: before 53.21.0.","status":"published","published":"2025-09-16T14:00:24Z","modified":"2026-06-05T11:41:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:51.774493Z"}],"ghsa":[{"id":"GHSA-m862-4wg2-7pg7","title":"Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output...","description":"Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'), Improper Control of Generation of Code ('Code Injection') vulnerability in Patika Global Technologies HumanSuite allows Input Data Manipulation, Format String Injection, Reflection Injection, Code Injection.This issue affects HumanSuite: before 53.21.0.","status":"published","published":"2025-09-16T15:32:37Z","modified":"2026-06-05T15:32:05Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:08:34.957049Z"}],"nvd":[{"id":"CVE-2025-8276","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Patika Global Technologies HumanSuite allows Cross-Site Scripting (XSS), Phishing.\n\nThis issue affects HumanSuite: before 53.21.0.","status":"published","published":"2025-09-16T14:15:56.49Z","modified":"2026-06-17T10:06:39.837Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-74","CWE-79","CWE-116"],"updated_at":"2026-11-02T14:11:29.650057Z"}]}}