Vulnerability details

CVE-2025-13183

Hotech Software Otello

Stored XSS in Hotech's Otello

CVSS 3.1

7.3High

Official description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hotech Software Inc. Otello allows Stored XSS. This issue affects Otello: from 2.4.0 before 2.4.4.

CVSS scores

Score	Version	Source	Vector
7.3High	3.1	CVEProject cvelistV5 (CNA) (TR-CERT)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
Hotech Software Inc.	Otello	2.4.0 ≤ v < 2.4.4	CVEProject cvelistV5 (CNA)

References and advisories

https://www.usom.gov.tr/bildirim/tr-25-0476 government-resourcebroken-link
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0476 government-resource

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-12-23
Last updated: 2026-06-04
State: Published
Assigner (CNA): TR-CERT

Exploit prediction (EPSS)

0.25%

Probability of exploitation in 30 days

16.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-79
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')