How severe is CVE-2025-61550?

CVE-2025-61550 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-61550 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-61550?

CVE-2025-61550 affects Edubusinesssolutions Print Shop Pro Webdesk. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-61550?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-61550 have an EU (EUVD) identifier?

Yes. CVE-2025-61550 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-1438.

When was CVE-2025-61550 published?

CVE-2025-61550 was published on 2026-01-08 and last updated on 2026-06-17.

CVE-2025-61550

CVE-2025-61550 is a medium-severity vulnerability in Edubusinesssolutions Print Shop Pro Webdesk with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-79.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
EPSS exploit prediction: 0% (8th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-1438
Weakness: CWE-79
Affected product: Edubusinesssolutions Print Shop Pro Webdesk
Published: 2026-01-08
Last modified: 2026-06-17

Description

Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69). User-supplied input is stored and later rendered in HTML pages without proper output encoding or sanitization. This allows attackers to persistently inject arbitrary JavaScript that executes in the context of other users' sessions

Frequently asked questions

What is CVE-2025-61550?: Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69). User-supplied input is stored and later rendered in HTML pages without proper output encoding or sanitization. This allows attackers to persistently inject arbitrary JavaScript that executes in the context of other users' sessions
How severe is CVE-2025-61550?: CVE-2025-61550 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-61550 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-61550?: CVE-2025-61550 affects Edubusinesssolutions Print Shop Pro Webdesk. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-61550?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-61550 have an EU (EUVD) identifier?: Yes. CVE-2025-61550 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-1438.
When was CVE-2025-61550 published?: CVE-2025-61550 was published on 2026-01-08 and last updated on 2026-06-17.

References

https://github.com/chndlrx/vulnerability-disclosures/tree/main/CVE-2025-61550

Affected products (1)

cpe:2.3:a:edubusinesssolutions:print_shop_pro_webdesk:18.34:*:*:*:*:*:*:*

More vulnerabilities in Edubusinesssolutions Print Shop Pro Webdesk

CVE-2026-26725 — Critical (CVSS 9.8): An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76) allows a remote attacker to escalate…
CVE-2025-61548 — Critical (CVSS 9.8): SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice…
CVE-2025-61546 — Critical (CVSS 9.1): There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro…
CVE-2025-61547 — Medium (CVSS 6.8): Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version…
CVE-2025-61549 — Medium (CVSS 6.1): Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu…

All CVEs affecting Edubusinesssolutions Print Shop Pro Webdesk →

Other CWE-79 (Cross-site Scripting (XSS)) vulnerabilities

CVE-2025-49410 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC…
CVE-2024-47875 — Critical (CVSS 10.0): DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to…
CVE-2024-6886 — Critical (CVSS 10.0): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea…
CVE-2023-45144 — Critical (CVSS 10.0): com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on…
CVE-2023-45138 — Critical (CVSS 10.0): Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly.…
CVE-2022-4361 — Critical (CVSS 10.0): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the…

Browse all CWE-79 (Cross-site Scripting (XSS)) vulnerabilities →