CVE-2025-13167 — Synology / Synology Contacts

CVE-2025-13167

Synology / Synology Contacts PUBLISHED

Description (CNA)

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read or write specific files containing non-sensitive information via unspecified vectors.

Affected (CNA)

Vendor / product	Versions
Synology / Synology Contacts	affected * before 1.0.10-20659

CWE

CWE-79

References

https://www.synology.com/en-global/security/advisory/Synology_SA_25_13

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.