CVE-2025-0876 PUBLISHED

XSS in Isin Basi Advertisement & IT's Workif

Assigner: TR-CERT
Reserved: 30.01.2025 Published: 03.10.2025 Updated: 06.06.2026

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Isin Basi Advertisement Information Technologies Trade Inc. IT's Workif allows Cross-Site Scripting (XSS).

This issue affects IT's Workif: through 20251003. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS Score: 4.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	Low
Privileges Required	High	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Isin Basi Advertisement Information Technologies Trade Inc.
Product	IT's Workif
Versions	Default: unknown affected from 0 to 20251003 (incl.)

Credits

Berat ARSLAN finder

References

Problem Types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') CWE

Impacts

CAPEC-63 Cross-Site Scripting (XSS)