Is CVE-2025-10914 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-10914 being exploited in the wild.

How severe is CVE-2025-10914?

High severity, with a CVSS score of 7.6, published 23 October 2025.

Is there a fix for CVE-2025-10914?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-10914 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-10914?

Check whether you run Proliz Software Ltd. Co. OBS (Student Affairs Information System) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-10914: Proliz Software OBS reflected XSS in Student Affairs Information System

CVE-2025-10914 · Severity: high · CVSS 7.6 · Published 2025-10-23

A security vulnerability has been identified in the Proliz Student Affairs Information System (OBS), a platform used by educational institutions to manage student records and academic data. This flaw allows attackers to perform reflected cross-site scripting (XSS) attacks, which could lead to the theft of user session cookies or unauthorized actions on behalf of students and staff. Organizations using this system should update to version V26.0401 or later to protect sensitive academic information and user accounts.

Technologies: Proliz Software Ltd. Co. OBS (Student Affairs Information System). Vendors: Proliz Software Ltd. Co..

Quick answers

Is CVE-2025-10914 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-10914 being exploited in the wild.
How severe is CVE-2025-10914?: High severity, with a CVSS score of 7.6, published 23 October 2025.
Which products and versions are affected?: Proliz Software Ltd. Co. OBS (Student Affairs Information System) before V26.0401.
Is there a fix for CVE-2025-10914?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-10914 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-10914?: Check whether you run Proliz Software Ltd. Co. OBS (Student Affairs Information System) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Proliz Software Ltd. Co. OBS (Student Affairs Information System) prior to version V26.0401. The application fails to properly neutralize user-supplied input during web page generation, allowing an unauthenticated remote attacker to inject malicious scripts. An exploit typically requires a victim to click a specially crafted link (User Interaction required). Successful exploitation can lead to the execution of arbitrary JavaScript in the context of the victim's browser session, potentially resulting in session hijacking or sensitive data disclosure. The issue is addressed in version V26.0401.

Affected products

Proliz Software Ltd. Co. OBS (Student Affairs Information System) before V26.0401

Timeline

2025-10-23: advisory: Initial publication of CVE-2025-10914

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.