CVE-2025-14691

MEDIUM

A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may b...

Affects 1 product across 1 vendor.

CVSS 3.16.1
CVSS v42.1
EPSS0.5%
Percentile38th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, can impact systems beyond the vulnerable component, no availability impact.
CWE Weakness Definitions
CWE-79: Cross-Site Scripting (XSS)

Attacker injects malicious scripts into web pages viewed by other users, executing in the victim's browser context.

CWE-94: Code Injection

Attacker injects arbitrary code that is executed by the application process.

Related Attack Patterns (CAPEC)
CAPEC-35 Leverage Executable Code in Non-Executable Files
via CWE-94
CAPEC-85 AJAX Footprinting
via CWE-79
CAPEC-209 XSS Using MIME Type Mismatch
via CWE-79
CAPEC-588 DOM-Based XSS
via CWE-79
CAPEC-591 Reflected XSS
via CWE-79
Show all 9
via CWE-79
via CWE-79
via CWE-94
via CWE-94

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A cross-site scripting (XSS) vulnerability was identified in Mayan EDMS up to version 4.10.1, affecting an unknown function in the /authentication/ file. This vulnerability can be exploited remotely, and the exploit is publicly available.

BSID: BS-2025-GLOBAL-233921-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-14691?
A cross-site scripting (XSS) vulnerability was identified in Mayan EDMS up to version 4.10.1, affecting an unknown function in the /authentication/ file. This vulnerability can be exploited remotely, and the exploit is publicly available.
What is the CVSS score for CVE-2025-14691?
CVE-2025-14691 has CVSS 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS: 0.5%.
Is CVE-2025-14691 actively exploited?
No confirmed active exploitation of CVE-2025-14691 as of 2026-10-08.
How do I remediate CVE-2025-14691?
Priority: HIGH.
What systems are affected by CVE-2025-14691?
CVE-2025-14691 affects Mayan-Edms Mayan Edms.
Vulnerability Details
CVE IDCVE-2025-14691
BSIDBS-2025-GLOBAL-233921-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published2025-12-14
Last Modified2026-10-07
ICS Relevance15%
Weakness (CWE)
Cross-Site Scripting (XSS)Code Injection
SourceNVD
Official Description

A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.10.2 is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms that this is "[f]ixed in version 4.10.2". Furthermore, that "[b]ackports for older versions in process and will be out as soon as their respective CI pipelines complete."

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The attack vector involves an unknown function in the /authentication/ file of Mayan EDMS, which can be exploited to perform cross-site scripting. The vulnerability can be triggered remotely, and the exploit is publicly available.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Mayan-Edms Mayan Edms < 4.10.2
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 305 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hasheb8bdfb7735cf204508ac478e2f59e85dc56198c461e7799b8344af66255c666d2173c4f96f528a07664dad6254adb0c9c267085cb150d0c4a89328b0d5d3970
Related CVEs affecting Mayan-Edms
CVE-2018-16405 6.1 An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets w... CVE-2018-16406 6.1 An issue was discovered in Mayan EDMS before 3.0.2. The Cabinets app has XSS ... CVE-2018-16407 6.1 An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS beca... CVE-2025-14692 6.1 A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an ... CVE-2022-47419 5.4 An XSS vulnerability was discovered in the Mayan EDMS DMS. Successful XSS exp...
View all Mayan-Edms CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →