Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject malicious JavaScript code that is executed in the context of a user s browser. This can lead to session hijacking, theft of cookies, and other malicious actions performed on behalf of the victim.
Advisories
Source ID Title
EUVD EUVD EUVD-2025-30714 Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject malicious JavaScript code that is executed in the context of a user s browser. This can lead to session hijacking, theft of cookies, and other malicious actions performed on behalf of the victim.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Tue, 14 Oct 2025 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Ard gec En Ligne
CPEs cpe:2.3:a:ard:gec_en_ligne:-:*:*:*:*:*:*:*
Vendors & Products Ard gec En Ligne

Wed, 24 Sep 2025 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Tue, 23 Sep 2025 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Ard
Ard ard
Vendors & Products Ard
Ard ard

Mon, 22 Sep 2025 19:00:00 +0000

Type Values Removed Values Added
Description Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject malicious JavaScript code that is executed in the context of a user s browser. This can lead to session hijacking, theft of cookies, and other malicious actions performed on behalf of the victim.
References

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-09-24T19:13:11.643Z

Reserved: 2025-08-16T00:00:00.000Z

Link: CVE-2025-55887

cve-icon Vulnrichment

Updated: 2025-09-24T19:13:08.361Z

cve-icon NVD

Status : Analyzed

Published: 2025-09-22T19:15:44.750

Modified: 2025-10-14T19:51:54.580

Link: CVE-2025-55887

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-09-23T16:09:48Z