Is CVE-2025-0878 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-0878 being exploited in the wild.

How severe is CVE-2025-0878?

Medium severity, with a CVSS score of 4.7, published 3 September 2025.

Which products and versions are affected?

AKINSOFT LimonDesk s1.02.14 to v1.02.17.

Is there a fix for CVE-2025-0878?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-0878 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-0878?

Check whether you run AKINSOFT LimonDesk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-0878: Akinsoft LimonDesk Cross-Site Scripting

CVE-2025-0878 · Severity: medium · CVSS 4.7 · Published 2025-09-03

Akinsoft LimonDesk, a customer support and desk management software, contains a security vulnerability that could allow an attacker to inject malicious scripts into the application. If exploited, this could lead to unauthorized actions being performed in the context of a user's session or the theft of sensitive information. The risk is mitigated by the fact that an attacker would typically need high-level administrative privileges to perform the exploit.

Technologies: AKINSOFT LimonDesk. Vendors: AKINSOFT.

Quick answers

Is CVE-2025-0878 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-0878 being exploited in the wild.
How severe is CVE-2025-0878?: Medium severity, with a CVSS score of 4.7, published 3 September 2025.
Which products and versions are affected?: AKINSOFT LimonDesk s1.02.14 to v1.02.17.
Is there a fix for CVE-2025-0878?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-0878 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-0878?: Check whether you run AKINSOFT LimonDesk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored or reflected Cross-Site Scripting (XSS) vulnerability exists in Akinsoft LimonDesk versions s1.02.14 through v1.02.17. The flaw stems from CWE-79, where the application fails to properly sanitize user-supplied input before rendering it in the web interface. An attacker with high privileges (PR:H) can exploit this over the network without user interaction to execute arbitrary JavaScript in the browser of other users. This could lead to session hijacking or unauthorized data modification. Users are advised to update to version 1.02.17 or later to remediate the issue.

Affected products

Akinsoft LimonDesk s1.02.14 to v1.02.17

Timeline

2025-09-03: advisory: NVD publication date
2025-09-03: disclosed: Initial disclosure by TR-CERT (USOM)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.