CVE-2025-59748

AndSoft e-TMS v25.03 is affected by a reflected XSS in the /clt/changepassword.asp endpoint. The vulnerability arises from lack of proper filtering/escaping of user-supplied data in the l and reset parameters, enabling an attacker to execute JavaScript in a victim’s browser via a malicious URL. P...