How severe is CVE-2025-61549?

CVE-2025-61549 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-61549 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (11th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-61549?

CVE-2025-61549 affects Edubusinesssolutions Print Shop Pro Webdesk. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-61549?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-61549 have an EU (EUVD) identifier?

Yes. CVE-2025-61549 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-1429.

When was CVE-2025-61549 published?

CVE-2025-61549 was published on 2026-01-08 and last updated on 2026-06-17.

CVE-2025-61549

CVE-2025-61549 is a medium-severity vulnerability in Edubusinesssolutions Print Shop Pro Webdesk with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-79.

Key facts

Severity: Medium (CVSS 3.x base score 6.1)
EPSS exploit prediction: 0% (11th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-1429
Weakness: CWE-79
Affected product: Edubusinesssolutions Print Shop Pro Webdesk
Published: 2026-01-08
Last modified: 2026-06-17

Description

Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76). Unsanitized user input is reflected in HTTP responses without proper HTML encoding or escaping. This allows attackers to execute arbitrary JavaScript in the context of a victim s browser session

Frequently asked questions

What is CVE-2025-61549?: Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76). Unsanitized user input is reflected in HTTP responses without proper HTML encoding or escaping. This allows attackers to execute arbitrary JavaScript in the context of a victim s browser session
How severe is CVE-2025-61549?: CVE-2025-61549 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-61549 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (11th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-61549?: CVE-2025-61549 affects Edubusinesssolutions Print Shop Pro Webdesk. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-61549?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-61549 have an EU (EUVD) identifier?: Yes. CVE-2025-61549 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-1429.
When was CVE-2025-61549 published?: CVE-2025-61549 was published on 2026-01-08 and last updated on 2026-06-17.

References

https://github.com/chndlrx/vulnerability-disclosures/tree/main/CVE-2025-61549

Affected products (1)

cpe:2.3:a:edubusinesssolutions:print_shop_pro_webdesk:18.34:*:*:*:*:*:*:*

More vulnerabilities in Edubusinesssolutions Print Shop Pro Webdesk

CVE-2026-26725 — Critical (CVSS 9.8): An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76) allows a remote attacker to escalate…
CVE-2025-61548 — Critical (CVSS 9.8): SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice…
CVE-2025-61546 — Critical (CVSS 9.1): There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro…
CVE-2025-61547 — Medium (CVSS 6.8): Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version…
CVE-2025-61550 — Medium (CVSS 5.4): Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the…

All CVEs affecting Edubusinesssolutions Print Shop Pro Webdesk →

Other CWE-79 (Cross-site Scripting (XSS)) vulnerabilities

CVE-2025-49410 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC…
CVE-2024-47875 — Critical (CVSS 10.0): DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to…
CVE-2024-6886 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea…
CVE-2023-45144 — Critical (CVSS 10.0): com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on…
CVE-2023-45138 — Critical (CVSS 10.0): Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly.…
CVE-2022-4361 — Critical (CVSS 10.0): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the…

Browse all CWE-79 (Cross-site Scripting (XSS)) vulnerabilities →