---
id: CVE-2025-61074
title: >-
  A stored Cross Site Scripting (XSS) vulnerability in the bulletin board
  (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 allows
  remote authenticated users to execute arbitrary JavaScript code in the web
  browser of other…
summary: >-
  A stored Cross Site Scripting (XSS) vulnerability in the bulletin board
  (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 allows
  remote authenticated users to execute arbitrary JavaScript code in the web
  browser of other…
severity: medium
cvss: 4.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: adata
product: mitarbeiter_portal
affected:
  - mitarbeiter_portal < 2.16.1
patched:
  - mitarbeiter_portal 2.16.1
published: '2025-12-09'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:10:00.327'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-61074'
references:
  - url: 'https://no-sec.net/posts/cve-2025-61074/'
    label: cve@mitre.org
  - url: 'https://www.adata.de/mitarbeiter-portal/'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00342
epssPercentile: 0.27523
ingestedAt: '2026-10-27T18:12:09.312Z'
---

## Overview

A stored Cross Site Scripting (XSS) vulnerability in the bulletin board (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 allows remote authenticated users to execute arbitrary JavaScript code in the web browser of other users via manipulation of the 'Inhalt' parameter of the '/SchwarzeBrett/Nachrichten/CreateNachricht' or '/SchwarzeBrett/Nachrichten/EditNachricht/' requests.

## Affected

- `mitarbeiter_portal < 2.16.1`

## Remediation

Upgrade past the affected range:

- `mitarbeiter_portal 2.16.1`