Eveo vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Eveo products: 1 record(s), with severity, exploitation and fixes.

URVE Smart Office 1

Exploited only (KEV) →

CVE-2025-10348 Medium · 5.1 CWE-79 Oct 30, 2025

Stored Cross-Site Scripting in URVE Smart Office

URVE Smart Office is vulnerable to Stored XSS in report problem functionality. An attacker with a low-privileged account can upload an SVG file containing a malicious payload, which will be executed when a victim visits the URL of the uploaded resource. The resource is available to anyone without any form of authentication. This issue was fixed in version 1.1.24.